chore(licence): normalise to MPL-2.0 + CC-BY-SA-4.0 (canonical pair)

.audittraining/security-errors/bunsenite.md

@@ -48,7 +48,7 @@ cargo audit
 #### Fix
 Pin base image with digest:
 ```dockerfile
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:... # Pin digest
 ```
 

.audittraining/security-errors/czech-file-knife.md

@@ -116,7 +116,7 @@ cargo audit -p cfk-providers
 ## ClusterFuzzLite Dockerfile Fix
 
 ```dockerfile
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 
 # Pin base image with SHA256 digest
 FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:abc123...

.audittraining/security-errors/gitvisor.md

@@ -39,7 +39,7 @@ No SAST (Static Application Security Testing) configured. For a multi-language r
 #### Fix
 Add CodeQL workflow with appropriate language matrix:
 ```yaml
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 name: CodeQL
 
 permissions: read-all
@@ -81,7 +81,7 @@ No automated test workflow detected.
 #### Fix
 Add test workflow:
 ```yaml
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 name: Tests
 
 permissions: read-all

.audittraining/security-errors/ubicity.md

@@ -29,7 +29,7 @@ Workflow lacks explicit `permissions:` declaration, inheriting default (often wr
 #### Fix
 Add at workflow level:
 ```yaml
-# SPDX-License-Identifier: MPL-2.0
+# SPDX-License-Identifier: CC-BY-SA-4.0
 name: RSR Antipattern Check
 
 permissions: read-all

.claude/CLAUDE.md

@@ -210,7 +210,7 @@ verisim-data (git-backed flat files) is the canonical data store. VCL queries ex
 - Elixir: `mix format`, SPDX headers on all files
 - Rust: `rustfmt`, `clippy`
 - Shell: `ShellCheck`, POSIX-compatible
-- SPDX-License-Identifier: MPL-2.0
+- SPDX-License-Identifier: CC-BY-SA-4.0
 
 ## Security Requirements
 

.machine_readable/agent_instructions/README.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Agent Instructions
 :toc: preamble

AFFIRMATION.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 //
 // RECONCILIATION (verified 2026-06-19 via public web): the hyperpolymath

CHANGELOG.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 
 = Hypatia Changelog

CHANGELOG.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-License-Identifier: MPL-2.0
+SPDX-License-Identifier: CC-BY-SA-4.0
 SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 -->
 

CODE_OF_CONDUCT.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Contributor Covenant Code of Conduct
 
 ## Our Pledge

CONTRIBUTING.md

@@ -1,4 +1,4 @@
-<!-- SPDX-License-Identifier: MPL-2.0 -->
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
 # Contributing
 
 Thank you for your interest in contributing! We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`.

GOVERNANCE.adoc

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: MPL-2.0
+// SPDX-License-Identifier: CC-BY-SA-4.0
 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 = Project Governance
 :toc: