release: implement site registry v0.4 trust pipeline

crates/argand-site-registry/LICENSE_SOURCES.md

@@ -1,6 +1,6 @@
 # Site Registry source licenses
 
-Reviewed against the primary distribution and licensing pages on 2026-09-12.
+Reviewed against the primary distribution and licensing pages on 2026-09-13.
 The Rust code uses the workspace's **AGPL-3.0-or-later** license. Imported data keeps
 its own licenses; neither the code license nor a merged export relicenses it.
 Commercial reuse is supported subject to the following obligations. A provider's
@@ -13,6 +13,7 @@ listing is evidence of an assertion, not a guarantee of ownership or safety.
 | Chrome UX Report (CrUX), Google | [CC BY 4.0 International](https://creativecommons.org/licenses/by/4.0/), [`CC-BY-4.0`](https://developer.chrome.com/docs/crux/methodology) | [Monthly BigQuery dataset](https://developer.chrome.com/docs/crux/bigquery/): `origin`, `experimental.popularity.rank`, observation month, optional audience-country dataset code. The adapter produces `origin,rank,yyyymm,country_code` CSV. Rank is a coarse bucket, not a precise visit count. Audience country is not website jurisdiction. No API key or OAuth token is retained. |
 | Curlie | [CC BY 3.0 Unported](https://creativecommons.org/licenses/by/3.0/), [`CC-BY-3.0`](https://curlie.org/docs/en/license.html), including the attribution placement prescribed on that page | [Format documentation](https://curlie.org/docs/en/rdf.html), [official download redirect](https://curlie.org/directory-dl), currently [Passau-hosted archive](https://share.innkube.fim.uni-passau.de/curlie-rdf/curlie-rdf-all.tar.gz). Despite its RDF name, the current archive contains **literal TSV**. Content: URL, title, description, category ID. Structure: category ID, full category path, entry count, description, latitude, longitude. Archive notices are retained. |
 | Public Suffix List contributors | [Mozilla Public License 2.0](https://mozilla.org/MPL/2.0/), [`MPL-2.0`](https://publicsuffix.org/list/public_suffix_list.dat) | [Official list](https://publicsuffix.org/list/public_suffix_list.dat). All ICANN and PRIVATE rules, wildcard/exception rules, version/commit comments and notices. Used for hostname, registrable-domain and public-suffix derivations. Download at most once per day. |
+| Argand candidate observer | [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/), `CC0-1.0` | Local host-side observations authored by the registry publisher: HTTP status and redirect targets, canonical/hreflang/JSON-LD/sitemap/country-selector targets, public DNS-set hash, TLS leaf-certificate hash, bounded failure class, content hash and selectors. These records describe a capture; they do not incorporate page prose or prove ownership. |
 
 ## Attribution and distribution
 
@@ -47,6 +48,11 @@ listing is evidence of an assertion, not a guarantee of ownership or safety.
   and `facts`; exports include the PSL fact and original download locator.
   Changes to covered PSL source files must remain available under MPL 2.0.
   The Rust `publicsuffix` parser is MIT/Apache-2.0; that is separate from the list.
+* **Argand observer:** locally produced observation metadata is dedicated under
+  CC0. The fetched page remains subject to its own rights. The default observer
+  stores only a bounded body in the local replay cache and emits normalized link,
+  status, hash and failure metadata. Publishers control and document retention of
+  local cache bodies; generated registry releases do not contain them.
 
 Every generation contains this document and `ATTRIBUTION.json`, both hash-bound
 by its signed completion receipt. Exports carry source manifests, licenses,