Put the wordmark on the README, and point at the canonical terms

The suffix names the mode a file is for, not the colour of its ink, so `-darkmode` is the pale wordmark that belongs on a dark page. Naming by ink reads backwards at the moment someone is picking a file in a hurry, and it collides with the logo variants, which are already named by mode.

The README points at one file unconditionally rather than switching on `prefers-color-scheme`, which reports the browser's setting and never the site's. A forge that renders dark whichever way the browser is set would then show dark ink on a dark page, silently, to a reader whose browser prefers light. Both files ship, so a mirror on a light-themed host changes one line where someone can see whether it worked.

The artwork is not covered by the GPL. Both the README and assets/README.md point at dejima's ATTRIBUTION.md for who holds the marks and what may be done with them, by absolute link, so a fork resolving it does not find its own divergent copy of the terms.

README.md

@@ -1,7 +1,20 @@
-# dejima-ci-hardener
+<!-- Fixed, not preference-aware, and that is the decision rather than an
+     oversight. `prefers-color-scheme` reports the browser's setting, never the
+     site's, and this is read on a forge that renders dark whichever way the
+     browser is set - so anything conditional shows dark ink on a dark page to
+     a reader whose browser prefers light, and does it silently.
+     The suffix names the mode a file is FOR, not the colour of its ink:
+     -darkmode is the pale wordmark that belongs on a dark page. A mirror on a
+     light-themed host swaps the filename below for dejima-wordmark-lightmode.png,
+     which is committed alongside for exactly that. One line, on the mirror,
+     where someone can see whether it worked. -->
+<img src="assets/dejima-wordmark-darkmode.png" alt="dejima" height="72">
 
-Hardens a CI runner host that executes agent-authored code on every pull
-request, and gives its jobs as little as possible to execute it with.
+# Continuous Integration Hardener
+
+Hardens a continuous integration runner host that executes agent-authored code
+on every pull request, and gives its jobs as little as possible to execute it
+with.
 
 **This is the only thing you clone onto a CI box.** It is self-contained -
 there is no step that copies files out of a dejima checkout, and dejima itself
@@ -320,3 +333,8 @@ and failing it means the runner needs attention rather than the branch.
 ## License
 
 GPL-3.0-or-later. See [LICENSE](LICENSE).
+
+The dejima wordmark and logo are not code and are not covered by that licence.
+They are trademarks; who holds them and what may be done with them is stated
+once for the organisation, at
+[dejima's ATTRIBUTION.md](https://gitbox.branderson.io/dejima/dejima/src/branch/main/ATTRIBUTION.md).

assets/README.md

@@ -0,0 +1,19 @@
+# assets
+
+The dejima wordmark, in the two versions the README needs: `-darkmode` for a
+page that renders dark, `-lightmode` for one that renders light. The suffix
+names the mode a file is for, not the colour of its ink, so `-darkmode` is the
+pale one.
+
+The README points at `-darkmode` unconditionally. A mirror on a light-themed
+host changes that one line; the comment above the tag says why it is not
+conditional.
+
+**These are trademarks and are not covered by this repository's GPL licence.**
+Who holds them, and what may be done with them, is stated once for the whole
+organisation:
+
+https://gitbox.branderson.io/dejima/dejima/src/branch/main/ATTRIBUTION.md
+
+The link is absolute so that a fork resolves it to the canonical terms rather
+than to its own copy.

test/addresses.bats

@@ -68,8 +68,13 @@ setup() {
 
     # git ls-files: only what is committed, and never .git or a stray render
     # left in the working tree by a local run.
+    #
+    # grep -I skips binary files. Without it an image's bytes can happen to
+    # contain something shaped like an address, and the guard fails on a file
+    # nobody can read or fix - which is how a check like this stops being
+    # trusted.
     found=$(cd "$REPO" && git ls-files -z \
-        | xargs -0 grep -hoE '\b([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?\b' 2>/dev/null \
+        | xargs -0 grep -IhoE '\b([0-9]{1,3}\.){3}[0-9]{1,3}(/[0-9]{1,2})?\b' 2>/dev/null \
         | sort -u | grep -vxE "$pattern" || true)
 
     if [ -n "$found" ]; then