Summary

• Align package license metadata with the MIT license file and README.
• Add local validation scripts, including CLI smoke and pack checks.
• Add oowl --version / -v support.
• Add package-root path constants for runtime package metadata access.
• Move security-auditor into the premium/deep custom-profile tier to match README intent.
• Harden OpenCode model scanning by trying non-shell execution first, then falling back to shell mode only when needed.
• Make dispatcher delegation-first behavior explicit in both the dispatcher agent and shared routing prompt.
• Add framework invariant tests for delegation-first, dispatch/scheduler boundaries, approval gates, and protected artifacts.

Not included

• The update/install safety rewrite for destructive overwrite and untracked/deleted file reporting was not committed because the connector safety filter blocked file updates containing that implementation. This should be handled in a follow-up PR from a local checkout.
• package-lock.json license metadata was not regenerated in this PR due connector payload constraints. Run npm install --package-lock-only locally before merging if you want lockfile metadata synchronized in this same PR.

Verification

Not run in this environment. Recommended checks:

npm test
npm run smoke:cli
npm run pack:check