chore(license): consent-aware-http hybrid (MPL-2.0 source + CC-BY-4.0 prose) (#350)

## Summary

Implements the hybrid licensing for `consent-aware-http` per the
2026-06-02 owner directive (memory:
`feedback_consent_aware_http_hybrid_licensing.md`).

This is a follow-on to standards#344/#345 which left
`consent-aware-http/` excluded pending design.

## Hybrid licensing model

| Aspect | License | Rationale |
|---|---|---|
| **Source files** (`.zig`, `.yml`, `.a2ml`, Mustfile, etc.) | `MPL-2.0`
| Estate sole-owner default; standards parent's AGPL does NOT inherit
here |
| **Prose / spec / docs** (`.adoc`, `.md`) | `CC-BY-4.0` |
IETF-compatible; aligns with how standards bodies license specs |
| **In-text reference** | `PMPL-2.0-or-later` | Spec text REFERENCES
PMPL-2.0-or-later for cultural/ethical/post-quantum framing. NOT applied
as SPDX. |
| **LICENSE file** | `MPL-2.0` (canonical) | Code is the operative
source-level license; CC-BY-4.0 docs are handled via per-file SPDX |

## Scope (39 files + LICENSE)

**10 prose files** flipped `PMPL-1.0-or-later` → `CC-BY-4.0`:
- `consent-aware-http/SECURITY.md`
- `consent-aware-http/GOVERNANCE.adoc`
- `consent-aware-http/ROADMAP.adoc`
- `consent-aware-http/MAINTAINERS.adoc`
- `consent-aware-http/RSR_OUTLINE.adoc`
- `consent-aware-http/.migration/PYTHON_TO_RUST_AFFINESCRIPT.adoc`
- `consent-aware-http/PALIMPSEST.adoc`
- `consent-aware-http/CONTRIBUTING.adoc`
- `consent-aware-http/SCOPE.adoc`
- `consent-aware-http/CHANGELOG.adoc`

**29 source/infra files** flipped `PMPL-1.0-or-later` → `MPL-2.0`:
- 3 `.zig` source files (ffi/zig/)
- 14 `.yml` workflows (.github/workflows/)
- 6 `.a2ml` manifests (.machine_readable/6a2/)
- 2 Mustfile + 1 Dustfile + 2 .gitattributes/.gitignore + 1
.github/FUNDING.yml

**1 LICENSE replacement**: `consent-aware-http/LICENSE` → canonical
MPL-2.0 text (was PMPL-1.0-or-later).

## Why draft

Hybrid model is a first-of-kind shape; owner sight before merge. Test
plan below.

## Test plan

- [ ] CI green (no new SPDX violations)
- [ ] CC-BY-4.0 on prose verifiable: `grep -rl 'SPDX-License-Identifier:
CC-BY-4.0' consent-aware-http/` returns 10 files
- [ ] MPL-2.0 on source/infra verifiable: `grep -rl
'SPDX-License-Identifier: MPL-2.0$' consent-aware-http/` returns 28+
files
- [ ] LICENSE file is canonical MPL-2.0
- [ ] Confirm spec text body in `drafts/*.xml` references
PMPL-2.0-or-later (no SPDX applied — that's intentional)

## Related

- standards#344/#345 — left consent-aware-http excluded pending this
design
- docs/LICENSE-POLICY.md (standards#349) — captures the hybrid model in
the canonical estate policy doc
- Memory: `feedback_consent_aware_http_hybrid_licensing.md`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

consent-aware-http/.gitattributes

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # RSR-compliant .gitattributes
 
 * text=auto eol=lf

consent-aware-http/.github/FUNDING.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Funding platforms for hyperpolymath projects
 # See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
 

consent-aware-http/.github/dependabot.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 version: 2
 updates:
   - package-ecosystem: "github-actions"

consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support

consent-aware-http/.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #

consent-aware-http/.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 

consent-aware-http/.github/workflows/jekyll-gh-pages.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Sample workflow for building and deploying a Jekyll site to GitHub Pages
 name: Deploy Jekyll with GitHub Pages dependencies preinstalled
 

consent-aware-http/.github/workflows/language-policy.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Language Policy Enforcement
 on: [push, pull_request]
 jobs:

consent-aware-http/.github/workflows/mirror.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Mirror to GitLab and Bitbucket
 
 on:

consent-aware-http/.github/workflows/rescript-deno-ci.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: ReScript/Deno CI
 on: [push, pull_request]