chore(license): replace 14 subdir LICENSEs + flip 446 SPDX stamps (Phase 4) (#106)

## Summary

Phase 4 of the developer-ecosystem PMPL→MPL-2.0 sweep. Companion to
#103/#104/#105.

This PR covers the **14 dev-ecosystem sub-projects that have their own
PMPL-1.0-or-later LICENSE files** (a more invasive change than the
SPDX-only flips in earlier phases — LICENSE file content is also
replaced).

## Why these sub-projects, not standalone repos

Verified via `gh api repos/hyperpolymath/<name>` that **none of these 14
sub-projects have standalone GitHub repos** — they're
dev-ecosystem-local (unlike the iser-tools/* or *iser standalones). So
fixing them in dev-ecosystem is the right place — no risk of divergence
from a parallel standalone.

## Scope

**14 subdir LICENSE files replaced** (PMPL-1.0-or-later → MPL-2.0
canonical text, sourced from the dev-ecosystem root `LICENSE`):
- `devkit-risc-v/`, `synapse/`, `bridge-nginx-zig/`,
`techstack-enforcer/`, `riscv-guix-buildsys/`, `idris2-ecosystem/`,
`packages/`, `opm-canonicalizer/`, `czech-file-knife/`, `dnfinition/`,
`well-known-ecosystem/`, `aggregate-library/`, `deno-ecosystem/`,
`rescript-ecosystem/rescript-dom-mounter/`

**Source SPDX flips** (count below — see verification).

## Explicitly EXCLUDED from this PR

- `rescript-ecosystem/rescript-vite/` — **EXCLUDED** as potential
upstream ReScript-Vite fork (same precautionary stance as
`rescript-tea/` and `affinescript-vite/`). Owner-flagged 2026-06-02.
Will be revisited separately after fork-vs-local classification.

## Verification

```sh
# All 14 Phase 4 subdir LICENSEs now MPL-2.0:
for d in <14 phase-4 subdirs>; do head -1 "$d/LICENSE"; done
# all return: SPDX-License-Identifier: MPL-2.0

# Source SPDX in Phase 4 scope:
grep -rl 'SPDX-License-Identifier: PMPL-1.0-or-later' <14 phase-4 subdirs>
# returns: 0 files
```

## Why draft

LICENSE file replacements are more invasive than SPDX flips. Owner sight
before merge.

## Pattern this PR follows

- `neurophone#102` for the SPDX-flip mechanics
- Same care-bracketing as `iser-tools/` (#104), but with the additional
LICENSE-file step
- `rescript-vite/` deliberately deferred for fork-vs-local
classification

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

aggregate-library/.formatter.exs

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 [
   inputs: ["{mix,.formatter}.exs", "{config,lib,test}/**/*.{ex,exs}"]
 ]

aggregate-library/.gitattributes

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf

aggregate-library/.github/dependabot.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 version: 2
 updates:
   - package-ecosystem: "github-actions"

aggregate-library/.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # CodeQL disabled - no scannable source code detected
 name: CodeQL Security Analysis
 

aggregate-library/.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #

aggregate-library/.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 

aggregate-library/.github/workflows/jekyll-gh-pages.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Sample workflow for building and deploying a Jekyll site to GitHub Pages
 name: Deploy Jekyll with GitHub Pages dependencies preinstalled
 

aggregate-library/.github/workflows/mirror.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
 name: Mirror to Git Forges
 

aggregate-library/.github/workflows/publish-container.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Publish Container
 
 on:

aggregate-library/.github/workflows/scorecard-enforcer.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer