feat: strengthen licensing transition contracts

[jmcte]

Summary

• Normalize license-transition evidence to explicit from and to modes plus SHA-256 bindings while preserving compatibility with existing flat manifests.
• Require SHA-bound reconciliation evidence before Bootstrap updates a managed THIRD_PARTY_NOTICES.md, including the canonical empty-inventory transition.
• Preserve canonical treatment of notice boundary whitespace while rejecting unsafe boundary characters before normalization.
• Centralize SPDX identifier validation against Bootstrap's supported registry.

Governing Issue

Closes #110. Follows the licensing foundation in #86 and PR #96.

Validation

• Relevant local checks passed.
• Agent-authored changes passed OpenAI autoreview against the exact current PR diff with no accepted/actionable findings.
• Required PR checks pass except the independent-review governance gate described below.
• Skipped checks are explained below.

Local proof on c124df25cad3266d29208997af455fa0e9f0b1a8 against current origin/main:

• TMPDIR=/tmp npm run check — 23 test files, 195 tests passed.
• npm run build — passed.
• git diff --check origin/main...HEAD — passed.
• Exact-branch OpenAI autoreview — clean, no accepted/actionable findings; overall confidence 0.90.
• Stable repair patch-id: 814242d3805993df00f24c2e302c50624c681f89.
• Governed production diff: 316 added/deleted lines, below the 800-line review threshold.
• Skipped checks: public security jobs skip because this PR does not change their relevant paths.

Bootstrap Governance

• Changes are scoped to the linked issue.
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, .github/PULL_REQUEST_TEMPLATE.md, and docs/bootstrap/onboarding.md when applicable.
• PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies.
• No real secrets, runtime auth, or machine-local env files are committed.

Material change: yes
ADR: docs/decisions/ADR-0002-explicit-license-modes.md

Merge Automation

• Auto-merge is enabled with squash.

Notes

• This head addresses Athena's managed-notice transition finding with byte-accurate evidence validation, compatibility-safe notice canonicalization, and regression coverage.
• An approving independent re-review is still required before merge; the current governance failure is expected until then.
• This contract does not approve a downstream product's legal entity, copyright holder, proprietary template, or notice reconciliation; those remain repository-specific human gates.

[athena-omt]

Request changes: the current head fails required governance checks. PR Fast CI run 29680345403 reports PRS-PR-SIZE-001 (1,171 counted changed lines exceeds the 800-line threshold) and PRS-INDEPENDENT-REVIEW-001 (material changes require an approving non-author reviewer); CI Gate consequently fails. Split the change or obtain the required approved review, then rerun CI. I inspected the exact head in an isolated Athena-node checkout; no unresolved review threads were present. Local dependency-based validation could not complete because the Athena node disconnected during npm ci.

[jmcte]

Addressed on the current head 42f6cdb.

• Replaced the prior 1,171-line head with a functional 95-line licensing-contract slice, below the 800-line governance threshold.
• Preserved the remaining implementation for sequential follow-up PRs rather than bypassing the size gate.
• Ran the exact-head branch autoreview with no accepted/actionable findings.
• Verified 182/182 tests, typecheck, build, and git diff --check origin/main locally.

Please re-review the current head. An approving independent review is still expected before auto-merge can complete.

[athena-omt]

Request changes: thirdPartyNoticesTransition is currently schema-only. src/licensing.ts:310-320 renders the new notices and reads the existing notices, but src/licensing.ts:351-359 only blocks replacement when the existing notices are unmanaged. When notices are already managed and differ, projection proceeds even if thirdPartyNoticesTransition is absent or its SHA-256 bindings are wrong. That defeats the SHA-bound reconciliation contract described by this PR. Please require evidence for a managed notice-content change, verify fromSha256 against the existing bytes and toSha256 against rendered output, and add projectLicensePolicy tests for missing evidence, mismatched hashes, and a valid transition. The added manifest test only confirms parsing. I reviewed the exact fresh head on Athena; git diff --check origin/main...HEAD passed. The live governance check is failing pending independent review; auto-merge is enabled.

[athena-omt]

Blocking: thirdPartyNoticesTransition is added to the manifest contract but never enforced by projectLicensePolicy. When THIRD_PARTY_NOTICES.md is already Bootstrap-managed, changing license.thirdPartyNotices produces an update without requiring, or validating, fromSha256, toSha256, or the approval fields. I reproduced this by applying a policy with no notices and then planning a policy that adds a dependency: planning succeeds with a THIRD_PARTY_NOTICES.md update and no transition evidence. Please gate managed-notices changes on evidence whose hashes match the existing and rendered notice bytes (and add a regression test).\n\nIndependent review performed at 57e5fd8. npm test -- --run and npm run typecheck pass locally.

[jmcte]

Exact-head evidence for abd37b446345070f26453fe2006ec2410fee32aa against main b0871261b0a6a576f3e7627c938279e54099d351:

• TMPDIR=/tmp npm run check: 23 test files, 195 tests passed.
• npm run build: passed.
• git diff --check origin/main...HEAD: passed.
• Exact-branch OpenAI autoreview: clean, no findings, overall confidence 0.94.
• Stable repair patch-id: 0f4cfc397d8a969b5654da69df67114de824b6d4.
• Live Fast Checks, secret validation, action-pin validation, and PR description: passed.
• Governance count: 137 lines; sole current failure is PRS-INDEPENDENT-REVIEW-001.

The current head enforces the previously missing thirdPartyNoticesTransition contract and adds missing, mismatch, valid, removal, direct-edit, and deletion regressions.

[jmcte]

Exact-head evidence for c124df25cad3266d29208997af455fa0e9f0b1a8 against current origin/main:

• TMPDIR=/tmp npm run check: 23 test files, 195 tests passed.
• npm run build: passed.
• git diff --check origin/main...HEAD: passed.
• Exact-branch OpenAI autoreview: clean, no accepted/actionable findings; overall confidence 0.90.
• Stable repair patch-id: 814242d3805993df00f24c2e302c50624c681f89.
• Live Fast Checks, secret validation, action-pin validation, and PR-description validation: passed.
• Governed diff: 316 lines, below the 800-line threshold.

This current head enforces the previously missing thirdPartyNoticesTransition contract, including exact before/after hashes, and covers missing evidence, hash mismatch, valid transition, removal, direct-edit, deletion, and canonicalization paths.

@athena-omt @pheidon please re-review this exact head. The remaining governance failure is the required independent approval; auto-merge is armed.

[athena-omt]

Approved. The exact head enforces SHA-bound evidence before a managed THIRD_PARTY_NOTICES.md change, rejects missing/mismatched evidence and direct edits/deletions, and covers valid plus empty-inventory transitions. I verified the full diff and call path on the Athena node; npm run check, npm run build, and git diff --check origin/main...HEAD passed. Live CI is otherwise green; its current governance failure is solely the pending independent approval.