chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair) (#51)

Estate licence normalisation. LICENSES/={MPL-2.0,CC-BY-SA-4.0}; root
LICENSE=verbatim MPL-2.0 (GitHub display); code->MPL-2.0,
docs(.md/.adoc)->CC-BY-SA-4.0; vendored untouched. Residual mentions
(mostly legitimate anti-AGPL rules): 55. Manual-review licence PR.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Scorecards supply-chain security
 
 on:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: MPL-2.0
 name: Secret Scanner
 
 on:

.machine_readable/agent_instructions/README.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Agent Instructions
 :toc: preamble

.php-cs-fixer.dist.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-// SPDX-License-Identifier: MIT OR PMPL-1.0-or-later
+// SPDX-License-Identifier: MPL-2.0 OR PMPL-1.0-or-later
 // SPDX-FileCopyrightText: 2024 Jonathan D.A. Jewell
 
 /**

CHANGELOG.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: MPL-2.0
+SPDX-License-Identifier: CC-BY-SA-4.0
 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 -->
 

EXPLAINME.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = php-aegis — PHP Security Toolkit — Show Me The Receipts
 :toc:

LICENSE

@@ -1,5 +1,3 @@
-SPDX-License-Identifier: MPL-2.0
-
 Mozilla Public License Version 2.0
 ==================================