chore(governance): LICENSE SPDX header + registry regen (#431)

## Summary

Two standing governance-debt fixes (owner-directed, 2026-06-26). Both
verified locally green.

### 1. LICENSE SPDX header (owner-authorised)
Root `LICENSE` had no `SPDX-License-Identifier:` line, failing
`scripts/check-licence-consistency.sh`. Added `SPDX-License-Identifier:
MPL-2.0`
(body text already MPL-2.0; header now matches). Check passes:
`[OK] LICENSE body text matches SPDX header.`

### 2. Registry drift regenerated
`.machine_readable/REGISTRY.a2ml` had drifted from the file tree.
Regenerated
via `just registry` (12 lines changed). `just registry-check` now
reports
`OK: registry + topology are in sync with the file tree.`

## Out of scope (flagged, not done)
- **105-finding Hypatia baseline** — needs the Elixir escript build (no
Elixir/mix in this environment; the bash fallback errors on the
1086-file
tree). Most of the tree is the `palimpsest-license` satellite
(legitimately
  PMPL/third-party, untouchable) or licence-flag-only findings. Separate
  scanner-dependent effort.
- **Stray PMPL header**: `.github/workflows/governance.yml:1` carries
`SPDX-License-Identifier: PMPL-1.0-or-later` (sole-owner repo → should
be
MPL-2.0). Licence edit — owner-only, **not** touched here. Flagging
only.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/REGISTRY.a2ml

@@ -36,7 +36,7 @@ name = "A2ML — Attested Markup Language"
 stream = "foundation"
 home = "a2ml/"
 canonical_doc = "a2ml/README.adoc"
-source_hash = "sha256:d911a6dfe0b61cbaadc0e39badf248d0b727ae26686a0f56dc3652e7d8301171"
+source_hash = "sha256:5f070c778ad112229878e2d551b564e2ec885d2239c6f348c0a96b700091d84a"
 route = "the typed/verified machine-readable document format"
 
 [[spec]]
@@ -45,7 +45,7 @@ name = "K9 Self-Validating Components"
 stream = "foundation"
 home = "k9-svc/"
 canonical_doc = "k9-svc/README.adoc"
-source_hash = "sha256:6820b8054e44669ce0193f730d6dbb3e4680d4b0207b54b97576b21d8b17ba4f"
+source_hash = "sha256:2fa2fe6394de60ac7da8672dcfeb21aa65919a7df83e8cf9ee9b82b2260ab0a8"
 route = "self-validating components with embedded contracts + deploy logic"
 
 [[spec]]
@@ -90,7 +90,7 @@ name = "AGENTIC.a2ml spec"
 stream = "foundation"
 home = "agentic-a2ml/"
 canonical_doc = "agentic-a2ml/README.adoc"
-source_hash = "sha256:489382852061480707944ea771cfc361205a2292c0eec152f0e26e97054a08aa"
+source_hash = "sha256:af9a28cddbe7781a8f773b2e390034f372471631c6d7db1f3ff9d8270d8deec3"
 route = "AI-agent operational gating / entropy budgets"
 
 [[spec]]
@@ -99,7 +99,7 @@ name = "NEUROSYM.a2ml spec"
 stream = "foundation"
 home = "neurosym-a2ml/"
 canonical_doc = "neurosym-a2ml/README.adoc"
-source_hash = "sha256:e264ce526d5149e501529aa4460057320f629ac5db41f6874f4ed8441d45695f"
+source_hash = "sha256:3c31b2644d96a97a6dfef19a5821b14e691e0622f01150b28688e36e6c7631a9"
 route = "symbolic semantics / proof obligations"
 
 [[spec]]
@@ -108,7 +108,7 @@ name = "PLAYBOOK.a2ml spec"
 stream = "foundation"
 home = "playbook-a2ml/"
 canonical_doc = "playbook-a2ml/README.adoc"
-source_hash = "sha256:b88c04050eebda9d0e888fe0f4b39dc01d8f98bd1ec456ff6aa90e177a620825"
+source_hash = "sha256:351da5ba66b38d8463a10e94c7b971b7d11aaff451b79ceb8c81f719363762d9"
 route = "executable operational runbooks"
 
 [[spec]]
@@ -117,7 +117,7 @@ name = "ANCHOR.a2ml spec"
 stream = "foundation"
 home = "anchor-a2ml/"
 canonical_doc = "anchor-a2ml/README.adoc"
-source_hash = "sha256:4492cb76436f0a077a290cee621dba43f4cc22ff447b42fc889d6a1cc1a0d214"
+source_hash = "sha256:3e447e1fac78311a9c466abaa9c5995a40783b8a23a12d74ce32c7906b0ee2e9"
 route = "project-recalibration intervention format"
 
 [[spec]]
@@ -126,7 +126,7 @@ name = "0-AI Gatekeeper Protocol"
 stream = "protocol"
 home = "0-ai-gatekeeper-protocol/"
 canonical_doc = "0-ai-gatekeeper-protocol/README.adoc"
-source_hash = "sha256:82c873694f1ddb581900794b26503225cc491e8cc5b2edf0d3043308272411a1"
+source_hash = "sha256:264806b26e710c04adbe7db357f638fdef1bd24a1bae7be9d9d50742a1e535ea"
 route = "the AI-agent entry/gating protocol behind 0-AI-MANIFEST"
 
 [[spec]]
@@ -144,7 +144,7 @@ name = "AVOW Protocol"
 stream = "protocol"
 home = "avow-protocol/"
 canonical_doc = "avow-protocol/README.adoc"
-source_hash = "sha256:ac360b0e415c40cab67f70cc3a06473eccdcc79f718558cfca23ea2bf9498a5c"
+source_hash = "sha256:ca167dc32551b71450176b9f9f7538c165b55ce19ee31f5cb7a334affd4edb3c"
 route = "consent-attested messaging / origin attribution"
 
 [[spec]]
@@ -153,7 +153,7 @@ name = "AXEL Protocol"
 stream = "protocol"
 home = "axel-protocol/"
 canonical_doc = "axel-protocol/README.adoc"
-source_hash = "sha256:6867f73559b0497e9f3bb51ba8d57023c7c8122f2af09f54ee708d9e7f8d3540"
+source_hash = "sha256:b9f31b9e5c77f1a26cbb4ee4cb29fcbc64079116c0c6e190f11dc5fbb9329449"
 route = "age-gating + explicit-content enforcement"
 
 [[spec]]
@@ -162,7 +162,7 @@ name = "Overlay Protocol"
 stream = "protocol"
 home = "overlay-protocol/"
 canonical_doc = "overlay-protocol/.machine_readable/6a2/ECOSYSTEM.a2ml"
-source_hash = "sha256:e39ef8666b33f6b4f4c2626af2a4f24146db0bca7a43aade01fc734ead9675da"
+source_hash = "sha256:59ed969ed2c189d31daa5a253d73f79ae9b2b8fdf690b24717a77a6803dc0f98"
 route = "layered overlay composition spec"
 
 [[spec]]
@@ -171,7 +171,7 @@ name = "Consent-Aware HTTP"
 stream = "protocol"
 home = "consent-aware-http/"
 canonical_doc = "consent-aware-http/README.adoc"
-source_hash = "sha256:fb2611536673928bd3ac6ac6f6097b431e2a6a6114f609674c6e9287f0c1f1e1"
+source_hash = "sha256:92e1d1c0252a69b8812cf0fa48bf2178f7f246314b1238a6d98eea9ed99fdb40"
 route = "consent headers / AI-usage boundaries for HTTP"
 
 [[spec]]
@@ -216,7 +216,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:96d4457b9fdd01e02bb89bf95aaca2dea002f18062342507d8b4f81af6ae79fb"
+source_hash = "sha256:830dca99ac78da5834a0f796da50bc4e3a1874782206347141530f6db49e3b97"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]

LICENSE

@@ -1,3 +1,5 @@
+SPDX-License-Identifier: MPL-2.0
+
 Mozilla Public License Version 2.0
 ==================================