chore(license): SPDX headers PMPL-1.0-or-later → MPL-2.0 (Closes #301)

Sweeps SPDX surfaces to MPL-2.0 across the affinescript repo while
keeping the PMPL narrative intact in `LICENSE`. Option 3 of the three
choices in #301 — preserves the PMPL-preferred + MPL-2.0-fallback
intent the root LICENSE has always documented, while making the
machine-readable side SPDX-recognised everywhere it matters (JSR, opam,
SBOM tooling).

Why this shape
--------------
The root `LICENSE` is explicit:

  PMPL-1.0-or-later is the PRIMARY/PREFERRED licence
  MPL-2.0 is the FALLBACK (legally-recognised) licence
  "MPL-2.0 was chosen as the fallback because PMPL-1.0-or-later
   is explicitly based on and extends MPL-2.0"

So PMPL was never the only licence — it's the preferred name for a
licence that legally falls back to MPL-2.0 wherever PMPL isn't
recognised. Practically: SPDX/JSR/opam tooling never recognised PMPL
and the fallback was already what applied at those surfaces. This
change makes that fact explicit in the SPDX headers (where tools look)
without altering the human-readable preference.

Scope
-----
- **SPDX headers, 1116 files:** `SPDX-License-Identifier: PMPL-1.0-or-later`
  → `SPDX-License-Identifier: MPL-2.0`.  Mechanical sed; touches
  source/.adoc/.md/.yml/.a2ml/.affine/.toml/.sh/.rs/.ml/.idr/.mjs.../*
  uniformly.  Excludes vendored sister-repo subtrees (`road-skate/`,
  `affinescript-vite/`) which carry their own licensing decisions.
- **Code generators** that emit SPDX strings (lib/error.ml,
  lib/lexer.ml, lib/protobuf.ml, lib/lua_codegen.ml, lib/cuda_codegen.ml,
  lib/cafe_face.ml, lib/pseudocode_face.ml, lib/c_codegen.ml,
  lib/why3_codegen.ml, lib/rescript_codegen.ml, and the Rust
  affinescriptiser sources): the emitted SPDX literal in
  `writeln!`/`Buffer.add_string`/`echo` follows the same change.  Newly
  scaffolded source files will now carry MPL-2.0 by default.
- **Machine-readable license fields:** `.machine_readable/6a2/META.a2ml`,
  `.machine_readable/svc/k9/examples/project-metadata.k9.ncl`,
  `affinescriptiser/.machine_readable/6a2/META.a2ml` — `"PMPL-1.0-or-later"`
  → `"MPL-2.0"`.
- **dune-project:** `(license "MIT OR AGPL-3.0-or-later")` → `(license "MPL-2.0")`.
  The pre-existing MIT/AGPL string was a stale OCaml-project-template
  leftover that didn't match either the PMPL preference or the SPDX
  headers anywhere else in the repo.  `affinescript.opam` regenerated
  by dune accordingly (now `license: "MPL-2.0"`).  Note: the top-level
  `dune-project` had diverged from `.build/dune-project` (the latter is
  no longer the symlink target it used to be); both updated in lockstep.
- **LICENSES/LICENSE-MPL-2.0:** added (canonical Mozilla 373-line text
  fetched from https://www.mozilla.org/media/MPL/2.0/index.txt).
  `LICENSES/LICENSE-PMPL-1.0` and the root `LICENSE` (its PMPL narrative)
  are intentionally retained.

Preserved deliberately
----------------------
- Root `LICENSE` body text — full PMPL preferred-licence narrative and
  the MPL-2.0 fallback explanation stay verbatim.  Only the file's own
  SPDX header (which describes the file's own license, not its contents)
  flipped.
- Narrative references to PMPL in `ALPHA-1-RELEASE-NOTES.md`,
  `BACKEND-IMPLEMENTATION.md`, `EXPLAINME.adoc`,
  `GAME-BUNDLING-STRATEGY.md`, the AGENTIC.a2ml comment — historical /
  architectural context, not machine-readable license data.

Verification
------------
- `dune build --release`: clean.
- `dune runtest --force`: 295/295 tests pass.
- Binary `--version`: 0.1.1.
- Shim `deno test`: 6/6 green.
- `grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later'` (excl. vendored
  subtrees) → empty.
- `grep '^license' affinescript.opam` → `license: "MPL-2.0"`.

Closes #301.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.build/dune-project

@@ -15,7 +15,7 @@
 
 (maintainers "hyperpolymath")
 
-(license "MIT OR AGPL-3.0-or-later")
+(license "MPL-2.0")
 
 (documentation https://github.com/hyperpolymath/affinescript)
 

.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 

.github/workflows/affine-vscode-publish.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Publishes @hyperpolymath/affine-vscode to npm on a scoped tag push.
 #
 # This repo is Deno-first (see CLAUDE.md). The npm publish here is a

.github/workflows/casket-pages.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
 
 on:

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CI
 
 on:

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:

.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards. Replaces ~8 duplicated per-repo governance
 # workflows (verisimiser#59 estate rollout). Load-bearing build/security

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 

.github/workflows/instant-sync.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 

.github/workflows/mirror.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
 name: Mirror to Git Forges