Restore the licence file and the readme lines that name it (#155)

[iderex]

Refs #155

What this changes

LICENSE and the six lines of README.md that name it are back on the default
branch. They are the last of the seven paths that
d3edfc95b8526033c79cb26afe48282c2c090e32 removed under a message describing a
change to how one workflow pin is commented; the other five path groups landed
in #157, #158, #159 and #160.

Both are the bytes that were there rather than a retyping of them, which is the
reading #155 asks to survive the repair:

git rev-parse 90656ba:LICENSE
fadd1f611bdae23852c5afe8ee6ba9f03617b34a
git hash-object LICENSE
fadd1f611bdae23852c5afe8ee6ba9f03617b34a
git rev-parse 90656ba:README.md
7f6f5a3b0cd06ed2e16b224d7848d4cde7977e8e
git hash-object README.md
7f6f5a3b0cd06ed2e16b224d7848d4cde7977e8e

README.md had not moved forward since the removal, so the blob comparison is
the right reading for it rather than a diff, and the change is 667 insertions
with no deletion:

git diff --stat origin/main...HEAD
 LICENSE   | 661 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 README.md |   6 +
 2 files changed, 667 insertions(+)

What failure it prevents

A public board whose front page invites a fork, a checkout and a change sent
back, while default copyright forbids all three. The cost falls on the reader
who does the work first and finds out afterwards.

What was run

At 36442adad2d9dc66032cf3d29ab070697650db5c, the four commands CONTRIBUTING.md
names, in that order:

go build ./cmd/... ./internal/...
exit=0
go vet ./cmd/... ./internal/...
exit=0
gofmt -l cmd internal
exit=0

gofmt -l printed nothing, which is its passing result.

go test -count=1 -v ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	0.389s
ok  	github.com/Flowfin/lab/cmd/lab	2.122s
ok  	github.com/Flowfin/lab/cmd/notices	6.243s
ok  	github.com/Flowfin/lab/cmd/pullrequest	0.413s
ok  	github.com/Flowfin/lab/internal/check	1.659s
ok  	github.com/Flowfin/lab/internal/contexts	0.696s
ok  	github.com/Flowfin/lab/internal/hardware	0.535s
ok  	github.com/Flowfin/lab/internal/invariants	1.150s
ok  	github.com/Flowfin/lab/internal/notices	0.548s
ok  	github.com/Flowfin/lab/internal/prose	0.837s
ok  	github.com/Flowfin/lab/internal/pullrequest	0.540s

and the runner against this tree:

go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
18 decision records read
the time this run read is 2026-08-22T01:11:13Z
0 refused
exit=0

The licence leg of the invariants prints the same line at this head as it printed
without the file, and that is the honest result rather than a regression:

  the licence: NOT ASKED, no licence is declared, so there is nothing to compare LICENSE against. asking costs answering entry one of the maintainer question issue and landing the file, the repository metadata and the decision record that names it, which is issue #47

I withheld LICENSE from the working tree with the readme section in place, to
see whether anything here reads the link the section adds. Nothing does:

go test ./internal/invariants -run TestThisRepositorySatisfiesTheInvariants -count=1 -v
      paths this repository's own documents name: 33 examined
    0 refused
--- PASS: TestThisRepositorySatisfiesTheInvariants (0.12s)

pathInProse in internal/check/check.go requires a leading directory segment
that record 0002 names, so a root file named in a document is outside what that
leg can see. That is a gap in the leg rather than in this change, and #162 holds
it.

What this does not do

It declares nothing anywhere a check reads. DeclaredLicence in
internal/invariants/invariants.go is still the empty string, the repository
metadata still reports no licence, and no decision record names one. Those are
#47 and they wait on entry one of #46.

It leaves README.md saying there is no licence file four lines above the
section that names AGPL-3.0. That paragraph was in the blob the removal took, so
restoring the bytes puts it back, and taking it out is a separate change with its
own reason rather than something to fold in here.

It does not finish #155. That issue also raises whether anything here should
refuse a merge that removes a tracked path without saying so in its body, and
restoring files does not answer it.

No second reader is available for this change tonight. The commands above and
their output stand in place of one, and every claim in this body is one of them
rather than a summary of them.