fix(init,detect): escape generated TOML and reject non-SPDX detected values

[knitli-proxy-coder]

🤖 Opened by Proxy Coder on behalf of Adam Poulemanos (@bashandbone)

Summary

licet init crashed validating its own generated config:

error: configuration error: invalid license.toml: TOML parse error at line 4, column 23
4 | license = "MIT\nx=1\n")"

Root cause was two stacked defects, both fixed here, plus REUSE hygiene so the bug's trigger can't recur.

1. Unescaped TOML in init (the crash)

render_config interpolated detected license strings straight into TOML basic strings via format!("license = \"{d}\"") — no escaping. Any value with a quote, backslash, or newline produced invalid TOML, which init then failed to re-parse. It now builds serde structs and serializes through the toml crate, so every value is correctly quoted/escaped.

2. Over-greedy SPDX detection (the junk value)

detect::parse_headers accepted any text trailing the SPDX-License-Identifier: tag as a license. Since the tag is matched anywhere on a line, scanning this project's own test sources captured MIT\nx=1\n") from a Rust string literal (tests/us5_reuse.rs). Captured values are now kept only when they parse as a valid SPDX expression (spdx::validate_expression); LicenseRef-* and compound expressions still pass.

3. REUSE-Ignore hygiene

The repo has no REUSE infrastructure of its own, so every SPDX tag the tooling sees is example/test data — and the example headers in docs/REUSE_Specification_v3.3.md were being inferred as a bogus GPL-3.0-or-later default. Wrapped the illustrative/test tags across the test suite, benches, the relevant #[cfg(test)] modules, and the spec doc in REUSE-IgnoreStart/REUSE-IgnoreEnd.

src/detect/mod.rs is intentionally left unwrapped: its test module sits past the 8 KB head licet scans (so it's never mis-detected), and its fixtures interleave unbalanced ignore markers that an outer wrapper can't cleanly balance for the reference reuse tool.

Verification

• licet init over this repo: exit 0, detects nothing (was: TOML parse crash, then bogus GPL-3.0-or-later).
• Added regression tests: detect rejects the non-SPDX token (still keeps clean MIT); init output is valid TOML under adversarial input; ordinary config round-trips.
• cargo test --all-targets, cargo fmt --all --check, and cargo clippy --all-targets -- -D warnings all pass.

Also bumps the mise cargo:licet pin (0.1.4 → 0.2.1).

🤖 Generated with Claude Code

Co-Authored-By: bashandbone 89049923+bashandbone@users.noreply.github.com
On-Behalf-Of: Adam Poulemanos (@bashandbone) (via knitli-proxy-coder[bot])