Relicense under Apache-2.0 and add contributor docs

[ndreno]

Summary

Relicenses Burst from AGPL-3.0 with a commercial dual license to Apache-2.0, and adds what outside contributors need before the project is announced.

Do not merge until @thomassaison has agreed to the relicense. His commits are part of the history, so relicensing them needs his consent. A comment on this PR saying so is enough.

Why Apache-2.0

• Burst's comparison point is Zulip, which is Apache-2.0 end to end (ADR-016). Burst's differentiator is footprint, not licensing, and AGPL is a reason for companies to pick Zulip instead.
• Inbound = outbound: contributions arrive under the license the project ships under, so a DCO sign-off is enough and no CLA or relicensing clause is needed.
• Apache over MIT for the explicit patent grant.

Compatibility

• Burst links no Barbacane crate. The gateway is a separate process, and shipping it in the all-in-one image is aggregation, so Barbacane stays AGPL.
• Every Rust dependency is permissive (r-efi is MIT/Apache/LGPL at our choice). The only non-permissive npm package is lightningcss (MPL-2.0), a build-time CSS tool that is not shipped.

Changes

• LICENSE holds the official Apache-2.0 text. LICENSING.md (dual licensing, commercial terms) is removed.
• The Cargo workspace license, the OpenAPI info.license (with SPDX identifier), docs/index.md and ROADMAP.md name Apache-2.0.
• New CONTRIBUTING.md: dev setup, the checks CI runs, Conventional Commits, DCO sign-off, ADRs.
• New CODE_OF_CONDUCT.md (Contributor Covenant, same as Barbacane), .github/SECURITY.md, issue forms for bugs and features, and a PR template.
• README: Contributing and License sections.

The license commit is chore(license)! so release-please lists it under breaking changes in the next release notes, with a bump to 0.3.0. If you'd rather it not bump the version, drop the ! and the BREAKING CHANGE footer when merging.

Testing

• make lint-spec passes.
• The issue forms parse as YAML. They render once merged to main.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• deep-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: barbacane-dev/burst/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 04cb9a62-664d-4c2d-bdbc-5c32cb3871f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}