Licence campaign follow-through: stop the MPL-normalise sweeper re-clobbering AGPL exceptions + estate hygiene

[hyperpolymath]

Summary

The AGPL-clobber incident (estate MPL-normalise sweep #40 = 5e390d7) is only
half-fixed. We fixed the detection side — the governance body classifier now
recognises AGPL (PR #501, merged) — but the prevention side is untouched: the
normalise sweeper that did the clobbering still has no AGPL exception list, so the
next run will re-flatten the co-developed games back to MPL-2.0.

This issue tracks closing the loop and the residual licence hygiene the campaign surfaced.

Prevention (root cause — the actual "stop it happening again")

• Locate the MPL-normalise sweeper tooling (the thing that produced sweep ci(antipattern): TS check reads .claude/CLAUDE.md exemption table #40 /
  commit 5e390d7).
• Teach it a canonical AGPL exception allowlist: airborne-submarine-squadron,
  the-nash-equilibrium (both co-developed games), plus any repo carrying a
  [CRITICAL] agpl-license invariant. The sweeper must skip these, not flatten them.
• Publish the allowlist as data (single source of truth) so the sweeper, the
  governance check, and humans all read the same list.

Per the estate CI/CD doctrine, prevention must be foundational, not a per-repo patch.
If the sweeper tooling lives somewhere unreachable, this is a STOP-and-chat item —
flagged here for that conversation.

Detection (done, recorded for the trail)

• check-licence-consistency.sh body classifier recognises full-text AGPL-3.0
  → PR fix(licence-check): recognise AGPL-3.0 in the body classifier #501 (merged). Propagates estate-wide via the default-branch script.

Residual licence hygiene (campaign remainder)

• the-nash-equilibrium: full AGPL restoration (tracked in its own repo issue).
• coq-jr: dangling LICENSE-AGPL / LICENSE-PMPL doc links + garbled
  "v3.0 or later (MPL-2.0)" text.
• academic-workflow-suite: stale "Why AGPL?" heading over a now-MPL repo.
• boj-server: stray AGPL manifest string.
• 44 repos with no root LICENSE at all — a distinct CI/CD gap; the governance
  check errors on absence. Audit + backfill (MPL-2.0 default, AGPL for the allowlist).

References

• Umbrella: [umbrella] Estate audit & optimization — make the enforcement real (Waves 0–6) #460 (estate audit — make enforcement real).
• Related: Reusable-workflow wrappers startup-fail estate-wide: callers grant narrower permissions than the reusable's jobs request #451 (reusable-workflow startup failures estate-wide).
• Incident restorations: asq PR fix(ci): move secret-scanner Cargo.toml gate from job-level if: to step-level #57/docs(policy): add canonical CODEOWNERS policy (standards#55) #58; the-nash issue (linked).