chore: standardize Open BSV License v6

[ty-everett]

Closes the licensing portion of #324 Wave 9.

Decision

Per administrator direction, every first-party package project in the TypeScript stack now uses the latest Open BSV License uniformly. The canonical text is Open BSV License Version 6, verified against the current BSV Association/Teranode license.

Open BSV License is not an SPDX-listed identifier, so npm metadata uses the valid file reference SEE LICENSE IN LICENSE.txt. The canonical bytes are pinned by SHA-256 bac995a0c84dd533f7d5335b6d870aae9fee7d28d189b8aa78b103e0c9932bc0.

Scope

• Standardizes all 46 npm manifests, covering:
  • all 30 public packages;
  • private package-area applications;
  • infrastructure services;
  • examples, conformance runners, docs, root tooling, and codegen.
• Installs an identical root-level LICENSE.txt in every package directory.
• Removes conflicting MIT/ISC/v4/v5 declarations and legacy LICENSE, LICENSE.md, and license.md package filenames.
• Updates every colocated package-lock.json root declaration.
• Normalizes all seven governed OCI components to LicenseRef-Open-BSV-License-6.
• Updates stale README license statements and adds the maintained licensing policy.
• Adds license:check and license:sync; repository health now rejects manifest, hash, filename, allowlist, or lockfile drift.
• Adds license:pack-check to the OIDC release workflow. It dry-packs the 30 public packages concurrently and confirms exactly one canonical root LICENSE.txt is shipped.
• Resolves all 11 outstanding repository-health license findings: 148 → 137 total findings, with 0 control errors.

This standardizes first-party project licensing. It does not relicense third-party dependencies or incorporated third-party material; existing required notices remain applicable.

Verification

• pnpm health:check — 22/22 policy tests; 46 manifests verified; 0 control errors
• pnpm license:pack-check — 30/30 public package tarballs verified (about 7 seconds locally)
• pnpm -r --filter '!@bsv/ts-stack' run build — all 36 non-root workspace projects passed
• pnpm --filter docs-site validate — 95/95 frontmatter and source-link checks passed
• docs production build — 95 routes, 100 built HTML link checks passed
• pnpm check-versions — pass
• pnpm audit:security — no known vulnerabilities
• git diff --check — pass

Release impact

No package or infrastructure image is published by this PR. All 30 public package manifests changed and therefore require patch releases in the final coordinated release wave; the release workflow will enforce the license payload before publication. Public-service CORS/CSP behavior is unchanged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer approval-in-substance (ty-everett): I reviewed the complete relicensing and enforcement diff, including the Sonar-requested refactor. The current authoritative Open BSV License Version 6 source/hash is documented; all 46 package projects, standalone lock roots, and seven OCI records are uniform; all 30 public tarballs contain the canonical file; 22 policy controls pass; repository-health license debt is zero; all build/test/coverage/CodeQL/dependency-review/Socket/infra/docs checks pass; and Sonar reports 0 new issues, 0 accepted issues, and 0 security hotspots. GitHub does not permit an author to submit a formal approval review, so this records the required maintainer review before the authorized admin merge.