fix: unshadow the license task, reconcile the template lock

[tschm]

Two tooling fixes from a /rhiza:quality run. No source or test changes, so the
performance figures in README.md and docs/paper/ are untouched.

make license silently no-oped on macOS (#96)

macOS defaults to case-insensitive APFS, where the LICENSE file at the repo
root satisfies make's search for a target named license: an existing file with
no prerequisites, so make declared it up to date and the shim's catch-all %:
rule never fired.

$ make license
make: `license' is up to date.

The copyleft scan reported success while scanning nothing — the one failure shape
a licence check must not have in a package whose reason to exist is being an
MIT-licensed replacement for a GPL-2.0 one.

Fixed in local.mk, which the shim's header names as the place for
repo-specific one-offs, and where an explicit rule beats the pattern rule.
.PHONY is what does the work: it tells make the target is a command rather
than a file. It could not be declared upstream in the generated shim, whose
header notes that .PHONY cannot name targets it does not know — and whose
claim that no file shares a task name is exactly what fails here.

Blast radius was local only. CI is unaffected (Linux is case-sensitive), and
make all was unaffected too, because it hands the whole graph to
uvx rhiza-task all, which resolves needs internally without consulting make.
Only the direct local call was broken.

After:

$ make license
$ uv run --with pip-licenses pip-licenses --fail-on=GPL;LGPL;AGPL --partial-match ...
      ok  license

template.lock disagreed with template.yml (#97)

The lock still listed .github/workflows/rhiza_mutation.yml under files: and
omitted it from exclude:, because it was written at the 2026-08-19 sync while
the exclusion landed 2026-08-21 (64d9b8b).

It matters because CLAUDE.md rule 4 points readers at the lock's files:
block as the authoritative list of template-owned paths, and for this one entry
it said the opposite of the truth: the file is excluded, so the next sync will
not re-deliver it. Two lines, bringing the record into line with the intent
rather than waiting for the next /rhiza:update to rewrite it.

Not included: #98

The _solve_with_factors complexity refactor is deliberately not here. It
worked — B(10) to A(3), package average 3.96 to 3.79, suite green at 100%
statement and branch coverage — but it cost a measured 3–4% at n <= 100, which is
3–4x the ~1% budget _solve.py's own comment records for the _steps split. See
the measurement in #98.

Gates

make fmt, make typecheck, make docs-coverage, make deps, make security,
make license, make rhiza-test and make test all pass locally — 1132 tests,
100% statement and branch coverage.

Closes #96
Closes #97

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR applies two tooling fixes identified by a /rhiza:quality run: it ensures make license always executes the Rhiza license gate on case-insensitive filesystems (macOS), and it reconciles the Rhiza template lockfile with the current template exclusion list.

Changes:

• Add a repo-owned local.mk override to make license a .PHONY target so it can’t be shadowed by the root LICENSE file on case-insensitive filesystems.
• Update .rhiza/template.lock to exclude .github/workflows/rhiza_mutation.yml and remove it from the synced files: list.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
local.mk	Adds an explicit .PHONY: license rule so make license runs the intended Rhiza task even on case-insensitive filesystems.
.rhiza/template.lock	Aligns the lockfile’s exclude:/files: entries with the template’s intent regarding the mutation workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.