0.2.1 — Version reporting fix + PolyForm relicense

No engine or tool behavior changes; golden fixtures unchanged.

Changed

• Relicensed from MIT to PolyForm Strict License 1.0.0
  (LICENSE.md): the repository stays public to read and
  use noncommercially, but is no longer open source — no modification,
  redistribution, or commercial use. Copies obtained under MIT before
  this change retain their MIT rights.

Fixed

• The version the server reports (MCP initialize handshake, /healthz,
  startup banner) is now read from package.json instead of a hardcoded
  constant in src/server/build.ts, which had silently stayed at 0.1.0
  through the 0.2.0 release — so the hosted demo's /healthz could not
  confirm a redeploy. package-lock.json had likewise never been bumped
  past 0.1.0; npm version now keeps it in step. A new test
  (test/version.test.ts) asserts the reported version equals
  package.json's.

Docs

• deploy/DEPLOY.md "Updating" now ends with a /healthz version check —
  the redeploy confirmation the fix above makes meaningful.
• Release tags v0.1.0 and v0.2.0 now exist (published 2026-08-16),
  so the compare links below use tag form. The [0.2.0] range
  previously ended one merge early (at PR #3 rather than the PR #4 merge
  that carried the version bump); corrected.