Land the licence entry one names

[iderex]

Closes #47

What this changes

LICENSE at the root is the GNU General Public License version 3, which is the
answer record 0018 writes down for entry one of #46. The text was fetched from
the Free Software Foundation rather than retyped, and the only departure from it
is the two lines of the appendix boilerplate the licence itself asks an author
to fill in:

$ curl -sS -o gpl-3.0.txt https://www.gnu.org/licenses/gpl-3.0.txt
$ diff gpl-3.0.txt LICENSE
634,635c634,635
<     <one line to give the program's name and a brief idea of what it does.>
<     Copyright (C) <year>  <name of author>
---
>     lab, experiments around Flowfin that do not have to finish.
>     Copyright (C) 2026  Nils Lehnen

Those two lines are the same two the file this replaces carried, so the
program name and the copyright line are unchanged by this. The conditional
interactive notice further down keeps the canonical placeholders, because that
notice is for a program that does terminal interaction in an interactive mode
and this runner does not, and filling it in would be asserting something that is
not true of what is here.

DeclaredLicence is set, and it is spelled as the title line rather than as the
SPDX identifier. That is forced rather than chosen: the leg asks whether the
licence file NAMES the declared licence, and the canonical text never writes an
SPDX identifier anywhere in it, so a constant reading GPL-3.0 would refuse the
very file it is about. The identifier is what the platform reports and what
README.md says; the constant is what the bytes at the root carry, and the
comment above it now says so along with what the spelling separates and what it
does not.

Five documents said this tree carried the Affero licence and would have been
false the moment this landed, so they move in the same change rather than after
it: README.md, SECURITY.md, docs/operator-guide.md, docs/promotion.md
and docs/supply-chain.md. Four of them also carried a sentence saying the
declared licence was still empty and open on this issue, and that half is
answered rather than deleted. The supply-chain paragraph keeps the commits that
restored the earlier file, because that history is true and is not what this
change corrects.

Means: the canonical licence text as bytes at the root, which is the form the
platform and every downstream reader parse, plus one Go constant in the package
that already reads that file. It adds no language, no runtime and no dependency,
and both the leg that judges the file and the fixtures that prove the leg bites
already exist.

What failure it prevents

A public repository whose terms nobody can rely on. Until this lands the tree
carries one licence, the decision record names another, and the check that would
notice reports that it was not asked. Any of the three read alone gives a
confident and different answer, and the reader who is hurt by that is the one
deciding whether they may reuse something.

It also ends the state the licence leg was built to make visible. A run that
could not check the licence printed NOT ASKED and passed, which is the honest
version of a gap and is still a gap: nothing compared the file at the root
against anything at all. After this the leg examines one subject and a wrong
file is a red run.

What was run

At d5bc879d7808b4b72212ee31118ed08e1cf0173e, from the root of the checkout:

$ go build ./cmd/... ./internal/...

$ go vet ./cmd/... ./internal/...

$ gofmt -l cmd internal

$ go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
25 decision records read
the time this run read is 2026-08-26T02:17:37Z
0 refused

$ go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	1.872s
ok  	github.com/Flowfin/lab/cmd/lab	21.712s
ok  	github.com/Flowfin/lab/cmd/notices	121.923s
ok  	github.com/Flowfin/lab/cmd/pullrequest	2.476s
ok  	github.com/Flowfin/lab/internal/check	2.720s
ok  	github.com/Flowfin/lab/internal/contexts	2.451s
ok  	github.com/Flowfin/lab/internal/hardware	2.504s
ok  	github.com/Flowfin/lab/internal/invariants	3.525s
ok  	github.com/Flowfin/lab/internal/notices	2.461s
ok  	github.com/Flowfin/lab/internal/prose	2.483s
ok  	github.com/Flowfin/lab/internal/pullrequest	2.483s

The leg this change exists to move, asked rather than assumed:

$ go test ./internal/invariants -count=1 -v -run TestTheLicenceLegSaysWhetherItWasAsked
=== RUN   TestTheLicenceLegSaysWhetherItWasAsked
--- PASS: TestTheLicenceLegSaysWhetherItWasAsked (0.14s)
ok  	github.com/Flowfin/lab/internal/invariants	3.615s

That test requires the opposite thing depending on whether a licence is
declared, so it passing here is not the same assertion it was passing before.
With the constant set, the run reports the licence: 1 examined instead of the
NOT ASKED line it printed on the default branch.

The guard was proved by breaking it, on the near miss somebody would actually
make. With the new declaration in place and the previous LICENSE blob put
back in the working tree:

$ git show origin/main:LICENSE > LICENSE
$ go test ./internal/invariants -count=1 -run TestThisRepositorySatisfiesTheInvariants
--- FAIL: TestThisRepositorySatisfiesTheInvariants (0.15s)
          the licence: 1 examined
          ..\..\LICENSE: this repository declares GNU GENERAL PUBLIC LICENSE and the file never names it (licence-file-does-not-match-the-declared-licence)
FAIL	github.com/Flowfin/lab/internal/invariants	3.001s

The file this change lands makes the same run green. That is the one-character
version of this mistake: declaring the answer and forgetting the file, or
landing the file and leaving the old one in place.

This change removes no tracked path.

What this does not do

The repository metadata still reports the old licence at the moment this is
written, and that is not something this branch can move. The platform derives
that field from the bytes it finds at the root of the DEFAULT branch, so it
reads the file this pull request replaces until the merge:

$ gh api repos/Flowfin/lab --jq '.license.spdx_id'
AGPL-3.0

The done-condition on #47 asks that the metadata report the chosen licence. It
is a detection rather than a declaration anybody sets, so it is read after the
merge rather than claimed here, and if it does not move the issue is not
finished by this change.

The declaration does not separate version 3 of this licence from version 2. Both
carry the same title, the comparison is a substring, and no reading of the file
closes that while it stays one. What guards the version is that the text was
taken from its canonical source, which is a sentence in the issue rather than a
check, and the comment at the constant says so rather than leaving a reader to
assume the leg is stronger than it is.

It does not place the commits made before it under these terms. Everything
committed until now arrived with no inbound terms at all. Record 0018 says so
and this file does not change it.

It does not touch docs/decisions/0018-the-licence-of-this-board.md, whose
paragraph on the disagreement between the answer and the file is written as the
state before this change and names this issue as what ends it. It also leaves
the sentence in docs/promotion.md that says entry three of #46 carries no
answer, which record 0020 has since answered. That sentence is stale for a
different reason than this change, it is a different topic, and it is not folded
in here.

This board has no second reader tonight. What stands in place of one is the diff
against the canonical text quoted above, the deliberate breaking of the guard,
and the full suite at the pushed commit.