chore: add Apache-2.0 and NOTICE, retire the docs that outlived their tools - #19

…heir tools

The repository had no LICENSE at all, which in a public repository means
"all rights reserved": nobody could legally fork, modify or `go get` a
module whose path is already github.com/MaimoryLab/OneAgent. Apache-2.0 was
chosen for its explicit patent grant and trademark clause.

NOTICE is the other half. distribution-compliance-policy.md has always
required a third-party licence manifest as a release precondition, but the
tool that generated it (cmd/oneagent-release) was removed in 23805b0, so the
obligation had no implementation. Every entry is read from disk rather than
assumed: the five Go modules actually linked into the desktop binary via
`go list -deps`, the five npm packages in the bundle, and the two runtimes
from runtimes.lock.json. The trademark section covers the eight Agent marks
in frontend/src/components/icons/assets, which agents.tsx already documents
as nominative use.

Three documents are removed rather than edited. agent-installer-target-versions.md
was internal strategy -- four unpublished conversion targets, SSO and unified
billing plans, and a hosted model gateway that product-boundary-baseline.md
explicitly lists as out of scope, so publishing both would have promised and
denied the same thing. The two concept documents were generation logs: one
carried a private image-proxy endpoint, and between them seventeen image
links point into the gitignored output/ directory, so they would have
rendered as broken images to any reader.

Twelve documents cited cmd/oneagent-release, cmd/oneagent-rc or
cmd/oneagent-provider-smoke, none of which exist. Removing them was
deliberate -- 23805b0 replaced them with build-artifacts.yml -- so the docs
are corrected rather than the tools restored. README and CLAUDE.md now
describe the workflow that runs; historical documents keep their conclusions
and gain a note saying the commands are background. Their command blocks are
retagged from `bash` to `text`, because a header note does not stop someone
scrolling to a shell block and running it. README also loses `task
test:native`, a target no Taskfile defines.

Two ADRs both claimed number 006. The public-site one becomes ADR-009, since
ADR-008's Supersedes line refers to the multi-profile one; ADR-006 now says
on its first line that its credential half is superseded, which previously
appeared only sixty lines down.

frontend/dist/.keep is restored: de3ed69 deleted it again, which re-broke
`go vet` on a fresh clone in exactly the way #16 fixed.

The cc-switch notes keep their findings but drop two conclusions that read
as disparaging a named individual's project; both are rewritten as the
methodological point they were actually making.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>