feat(05-02): add LEGAL.md, embed it, and wire keyhunter legal command

- Add LEGAL.md at repo root (109 lines) covering CFAA, Computer Misuse Act,
  EU Directive 2013/40/EU, responsible use, disclosure, and disclaimer.
- Mirror to pkg/legal/LEGAL.md for go:embed (Go cannot traverse parents).
- Add pkg/legal package exposing Text() for the embedded markdown.
- Add cmd/legal.go registering keyhunter legal subcommand to print it.

pkg/legal/legal.go

@@ -0,0 +1,17 @@
+// Package legal exposes the KeyHunter legal disclaimer as a compile-time
+// embedded string.
+//
+// Note: Go's //go:embed directive cannot traverse parent directories, so the
+// canonical LEGAL.md lives at the repo root (for user visibility) AND a
+// byte-identical copy lives at pkg/legal/LEGAL.md (for embedding). This
+// mirrors the dual-location pattern used in Phase 1 for provider YAML files
+// (providers/*.yaml vs pkg/providers/definitions/*.yaml).
+package legal
+
+import _ "embed"
+
+//go:embed LEGAL.md
+var legalMarkdown string
+
+// Text returns the embedded LEGAL.md contents.
+func Text() string { return legalMarkdown }