chore(license): finish PMPL-1.0 -> MPL-2.0 migration stragglers; retire Palimpsest artifacts

The PMPL-1.0-or-later -> MPL-2.0 migration landed earlier (a740439, #52); this
clears the remaining stragglers, mirroring julia-the-viper's gap-006 resolution.

- SPDX-License-Identifier: PMPL-1.0 -> MPL-2.0 in scorecard.yml + secret-scanner.yml
  (codeql.yml + the README badge were already done on main).
- threat-model.a2ml: drop the "until PMPL is formally recognised" note (PMPL retired).
- Retire stale Palimpsest artifacts: PALIMPSEST.adoc (still claimed PMPL-1.0,
  contradicting the completed migration), LICENSE.txt (old PMPL license text;
  canonical LICENSE is already MPL-2.0), LICENSES/PMPL-1.0-or-later.txt (unused
  now that no file declares PMPL).

Canonical LICENSE (MPL-2.0) unchanged. Remaining minor follow-ups (NOTICE prose,
a k9 setup-example, guix/flake license fields) noted for a later pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742

Author: claude

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
 
 on:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
 
 on:

.machine_readable/threat-model.a2ml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
-# (MPL-2.0 is automatic legal fallback until PMPL is formally recognised)
+# (Licensed under MPL-2.0; the standalone PMPL-1.0 is retired per the estate standard.)
 #
 # threat-model.a2ml — DRAFT threat model for exposing januskey via an MCP cartridge
 #