chore: add a contributor license agreement; name @fylorn as BSL licensor

[fylorn]

Not legal advice. The agreement below was drafted in plain language for this project, not by a lawyer. Have it reviewed before relying on it, in particular the relicensing grant (section 3), the licensor's right to transfer (section 6), and the absence of a governing-law clause.

What this adds

• CLA.md, the Contributor License Agreement, identical in ThinkWatch, ThinkWatch Lite and ThinkWatch Core and naming all three as the covered repositories. The contributor keeps copyright and grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable licence to use, modify, distribute, sublicense and relicense under any terms, including proprietary and commercial ones; a patent licence that ends for anyone who brings patent litigation over the contribution or the project; the usual representations (original work or identified third-party material, right to grant, employer permission); no obligation to use the contribution; no warranty; a duty to report inaccuracies. The licensor is the holder of the GitHub account @fylorn (https://github.com/fylorn), and that holder's heirs, successors and assigns, and section 6 lets the licensor assign the rights, in whole or in part, to any person or entity (for example a company formed later to run the project), with the grant then benefiting the assignee. Section 10 tells signers which signature data is stored publicly.
• CLA.zh-CN.md, a Chinese translation that states the English text governs.
• .github/workflows/cla.yml, which runs CLA Assistant Lite v2.6.1, pinned to ca4a40a7d1004f18d9960b404b97e5f30a505a08 (the latest release; the tag points directly at that commit).
• CONTRIBUTING.md: a short section on signing once.

How the workflow behaves

• Triggers: pull_request_target (opened, synchronize, reopened, closed) and issue_comment (created). The job runs for PR events (a close only if merged, to lock it), and for PR comments that are exactly I have read the CLA Document and I hereby sign the CLA or recheck.
• It never checks out or runs PR code: no actions/checkout, no build. It uses only GITHUB_TOKEN; no personal access token, no cross-repository token.
• Signatures go to signatures/cla.json on a cla-signatures branch of this repository. A first step creates that branch if it is missing, as an orphan holding only the signature file. This step is needed: the action's own "create the file" path never runs, because v2.6.1 compares the 404 for a missing file with the string "404" (dist/index.js line 984), so a missing branch or file fails every run. The orphan branch has no workflows on it and writes made with GITHUB_TOKEN start no workflow runs, so recording a signature triggers no CI; no CI trigger needed an exclusion.
• Permissions: actions: write (the action re-runs the failed check after someone signs), contents: write (signature file), pull-requests: write (comments, post-merge lock). The action's README also lists statuses: write, but the action never calls the commit status API (checked in its source at the pinned commit), so it is left out.
• Allowlist: fylorn,dependabot[bot],renovate[bot],github-actions[bot],*[bot] (the action supports * wildcards).
• After a merge the conversation is locked (lock-pullrequest-aftermerge: true), as the action recommends.
• path-to-document points at CLA.md on main, the default branch.

When it starts working

pull_request_target runs the workflow from the PR's base branch, so once this is merged into dev, PRs opened against dev after that get the bot's comment and the check. Signing by comment works only once cla.yml is on main (the next release, when dev reaches main): issue_comment always runs the copy on the default branch. Until then a signature comment is not acted on right away; the next push to that PR picks it up, because the synchronize run reads the PR's comments. The CLA.md link in the bot's comment points at main too, so it returns 404 until then. Nothing was pushed to main for this.

Licensor in the Business Source License

Every changed line outside the new files and CONTRIBUTING.md:

LICENSE (BSL 1.1 text and every other parameter unchanged):

-Licensor: ThinkWatch Contributors
+Licensor: The holder of the GitHub account @fylorn (https://github.com/fylorn),
+and that holder's heirs, successors and assigns

README.md, Contributing section, one added line:

+Your first pull request asks you to sign the [Contributor License Agreement](CLA.md) once; [CONTRIBUTING.md](CONTRIBUTING.md) explains how.

README.zh-CN.md, 贡献 section, one added line:

+首次提交 PR 时需签署一次[贡献者许可协议](CLA.zh-CN.md)，签署方法见 [CONTRIBUTING.md](CONTRIBUTING.md)。

Searched for other places that name a licensor or a party granting commercial licences: LICENSING.md, LICENSING.zh-CN.md, both READMEs, docs/, web/ (i18n strings, the Usage & License page), deploy/helm/think-watch/Chart.yaml, web/package.json, Cargo metadata. None do, so nothing else changed. "ThinkWatch Contributors" appeared only in LICENSE.

Open items for the maintainer:

• The new Licensor applies to versions released from now on; versions already released carry the LICENSE they shipped with.
• ThinkWatch Lite and ThinkWatch Core are not changed in this round: their LICENSE says Copyright (c) 2026 ThinkWatch, and Lite's NOTICE says Copyright (c) ThinkWatch Project.

Not changed here

• The CLA status check is not required. Making it a required check is a repository setting left to the maintainer.
• Existing workflows (CI, release and, where present, the PR base guard and audit) are untouched.

Verified

• actionlint 1.7.12 with shellcheck: no findings for cla.yml.
• Read the action's source at the pinned commit for inputs, allowlist matching, the 404 comparison, the lock-on-close path and which APIs it calls.
• Ran the jq payloads of the branch-creation step locally; the file content parses as {"signedContributors": []}, the shape the action reads and appends to.
• The workflow has not run yet. It first runs on a PR opened after this is merged.

🤖 Generated with Claude Code