[Daniel-park10]

Summary

GitHub recognizes lowercase filename conventions across repositories (such as license, licence, copying, and .github/security.md). On repositories using lowercase naming like sindresorhus/slash, darnit currently fails license and security checks because locators, pattern matchers, and auto-detection functions only search for uppercase variants (LICENSE, SECURITY.md, etc.).

This PR adds lowercase filenames and standard path variants (.github/security.md, docs/security.md) across baseline license and security controls, hint sources, and detect_license_type(). It also adds regression tests covering all casing and directory combinations, including the exact sindresorhus/slash layout.

Fixes #717

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update
• Refactoring (no functional changes)

Framework Changes Checklist

If this PR modifies the darnit framework (packages/darnit/):

• Updated framework spec (docs/architecture/framework-design.md) if behavior changed
• Ran uv run python scripts/validate_sync.py --verbose and it passes

Control/TOML Changes Checklist

If this PR modifies controls or TOML configuration:

• Control metadata defined in TOML (not Python code)
• SARIF fields (description, severity, help_url) included where appropriate
• Ran validation to confirm TOML schema compliance

Testing

• Tests pass locally (uv run pytest tests/ -v)
• Added tests for new functionality (if applicable)
• Linting passes (uv run ruff check .)

AI assistance

• No AI assistance was used
• AI assistance was used

Additional Notes

None.

[Marc-cn]

CI failure is the feature-036 golden, not the change: tests/darnit/fixtures/error_class_baseline/baseline.md snapshots an audit of a repo without a license, and OSPS-LE-03.01's 'None of the required files found' line now lists the lowercase names too. Please run uv run python tests/darnit/fixtures/error_class_baseline/capture_baseline.py and commit the three regenerated files (md, json, sarif) — the baseline was refreshed the same way in #552 and #603 for intentional message changes, and nothing here touches error_class. Checked on the VM: with the regenerated gold, context + controls + sieve + happy-path tests pass (837). Follow-up, not for this PR: listing the directory and matching case-insensitively would cover Security.md / License.MD and every other spelling in one place, instead of growing these lists.