TIGER-317: emit <meta name="generator" content="Tiger">, flag-defaulted on

[WebTigers]

Why

Tiger announced nothing — no generator meta, no X-Powered-By, no badge. But every page already
ships tiger.modal.js, tiger.tabs.js and id="tiger-main", so a Tiger site has always been
trivially fingerprintable. The silence bought no obscurity; it only kept Tiger out of the technology
surveys (W3Techs / BuiltWith / Wappalyzer) that build CMS market-share tables off the generator tag.
An install that emits nothing is counted as nobody.

Now every install is countable, and a site that would rather not be says so in one checkbox.

Name only, never a version

A version string here hands a vulnerability scanner the exact build to match CVEs against, across an
install base nobody patches on our schedule — and no detector needs it. The content is a literal and
a guard test enforces that, so it cannot drift back in.

The flag

tiger.site.generator_meta, shipped = 1 in configs/core.ini — in the site-identity block
beside tiger.site.name / home_page / description, the keys the CMS Settings screen already
owns. The default is declared, not inferred from a missing key. Stored positively so the ini line
reads the way the feature works.

• Tiger_Application_Bootstrap seeds $view->showGenerator beside $view->siteName. A missing key
  still reads as on — the flag fails visible.
• The base theme's public layout emits the tag when it isn't hidden. A view built outside the
  bootstrap has no such property and still emits.
• Settings → CMS → Site Settings gains "Hide Tiger meta tag". The checkbox asks the opposite
  question from the flag, and Cms_Service_Settings is the single place the two are reconciled.
• cms.settings.js sends an explicit "0" — an unchecked box submits nothing, so without it the
  opt-out could never be reversed.
• i18n in all seven locales.

Tests

The real layout block is lifted out of the shipped file and rendered in all three states
(shown / hidden / property absent), the ini default is asserted, and the config round trip covers
the un-tick. Every one mutation-checked:

mutation	failures
version added to content	3
tag ungated	4
ini default flipped to 0	1
ini default deleted	1
polarity reversed	4
service write removed	4

Full suite green: 2545 tests, 22751 assertions.

Known limits

• Not yet exercised in a browser on dev — the VPN was down. Server-side render is proven by test.
• A theme shipping its own layout owns its own head. puma and Grey Mist render the head registry;
  theme-crafto-interior and theme-porto do not, so a site on those won't emit the tag until their
  layouts carry it. Same way headTitle / headMeta already behave.
• The tag alone changes nothing until the detectors have a rule for it — submitting Tiger to
  W3Techs / Wappalyzer / BuiltWith is the actual marketing payoff and stays on TIGER-317.

TIGER-317

🤖 Generated with Claude Code

https://claude.ai/code/session_013vdyTeoDrGE4hKxt53TsE8