docs(license): exclude agent-meta from CC-BY-SA; scrub PMPL philosophy (owner follow-up)

Follow-up to the licence normalisation, per the owner's refined scope.

- Revert agent-instruction files to MPL-2.0 (exclude them from the docs ->
  CC-BY-SA relicense): .claude/CLAUDE.md, .claude/PROJECT.md,
  .github/copilot-instructions.md.
- Scrub residual PMPL-as-licence-philosophy from prose:
  - docs/FEDERATION.adoc: drop the "the PMPL license encodes this principle
    legally" sentence; reword provenance bullet (PMPL label removed).
  - docs/architecture/README.adoc: reword provenance bullet to drop the
    "license's requirements ARE the attestation" framing.
  - docs/status/ROADMAP.adoc + docs/outreach/show-hn-draft.md: clarify these
    reference the pmpl-mcp *cartridge* (a product), not boj-server adopting PMPL.

Kept (legitimate): the consent-aware-http prospective-PMPL note (correct estate
policy), the pmpl-mcp cartridge + catalogue, and a conceptual PMPL comment in
src/abi/Boj/Federation.idr (code — out of scope for this docs pass).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XrPAh7eBSUcVKauTVdXH9Y

Author: claude

.claude/CLAUDE.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: CC-BY-SA-4.0
+SPDX-License-Identifier: MPL-2.0
 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # CLAUDE.md - AI Assistant Instructions

.claude/PROJECT.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: CC-BY-SA-4.0
+SPDX-License-Identifier: MPL-2.0
 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 # BOJ Server - Claude Code Instructions

.github/copilot-instructions.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: CC-BY-SA-4.0
+SPDX-License-Identifier: MPL-2.0
 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 -->
 <!-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> -->

docs/FEDERATION.adoc

@@ -46,8 +46,6 @@ The model: you don't need a hosting budget if the community IS the hosting.
 
 This is non-punitive. We don't brick your installation. We just don't vouch for it.
 
-The *PMPL license* encodes this same principle legally — provenance metadata with cryptographic signatures is required, so the legal framework and technical framework express the same thing.
-
 === Gossip protocol
 
 Nodes discover each other via IPv6 gossip:
@@ -138,7 +136,7 @@ Community nodes benefit from the full BoJ security stack:
 * *DoQ/DoH*: Encrypted DNS resolution for all BoJ traffic
 * *oDNS*: Oblivious DNS relay option for maximum privacy
 * *Hash attestation*: Binary integrity verification
-* *PMPL provenance*: Cryptographic lineage tracking
+* *Cryptographic provenance*: lineage tracking
 
 == Future: Dynamic Threat Response
 

docs/architecture/README.adoc

@@ -334,7 +334,7 @@ BoJ servers are community-hosted, like Tor or IPFS:
 * *Tampered nodes*: excluded from the community network, but can still run locally
 * *Gossip protocol*: nodes discover each other via IPv6 gossip (Byzantine fault tolerant)
 * *Load-aware routing*: requests go to healthy nodes (under 80% capacity) — _not yet wired_
-* *PMPL provenance*: the license's cryptographic provenance requirements ARE the attestation
+* *Cryptographic provenance*: signed lineage metadata complements the hash attestation
 
 === Seed Nodes (Day 1)
 

docs/outreach/show-hn-draft.md

@@ -8,7 +8,7 @@ BoJ (Bundle of Joy) is an MCP server that bundles 99 tool cartridges — each wi
 
 What makes it different:
 
-- **99 cartridges** covering cloud (Cloudflare, Vercel), comms (Gmail, calendar), GitHub/GitLab, databases, containers, security (DNS Shield, container hash monitoring, PMPL provenance), browsers, and more
+- **99 cartridges** covering cloud (Cloudflare, Vercel), comms (Gmail, calendar), GitHub/GitLab, databases, containers, security (DNS Shield, container hash monitoring, licence-chain provenance via pmpl-mcp), browsers, and more
 - **Formal safety proofs** — every cartridge has an Idris2 ABI module with dependent types and zero `believe_me` postulates. The type system prevents entire classes of runtime errors
 - **Zero Python, zero TypeScript** — built with Zig (FFI), Idris2 (proofs), and a ReScript UI. No npm, no pip, no node_modules
 - **Glama AAA grade** — Security A, License A, Quality A

docs/status/ROADMAP.adoc

@@ -64,7 +64,7 @@ zig adapter migration complete (0 `.v` files).  Grade C achieved 2026-04-25.
 * [x] SDP cartridge (auto-SDP for community nodes)
 * [ ] DNS Shield cartridge (DoQ/DoH/oDNS)
 * [ ] Container hash state monitoring (vordr integration)
-* [ ] PMPL provenance chain verification
+* [ ] pmpl-mcp cartridge: licence-chain verification
 
 === v1.0.0 — Matrix Fill (Phase 6)