fix(supply-chain): separate root MIT license from bundled font notices

[seonghobae]

Stable acquisition / license-detection contract

This issue owns the buyer-visible software-license detection defect. Protected main is the only shipped-source authority. Canonical Draft PR #270 / branch fix/license-detection-269 is the existing single writer for the repair; its exact head, live protected base, ancestry, mergeability, reviews, threads, workflows, and release applicability are mutable and must be refetched immediately before every lifecycle action rather than copied into this issue as current status truth.

The required product contract is deliberately narrow:

• root LICENSE contains the canonical MIT software license text only;
• bundled Noto font attribution remains in src/fonts/NOTICE;
• complete OFL-1.1 terms remain in src/fonts/OFL.txt beside the bundled font assets;
• package.json continues to declare license: MIT and includes root LICENSE plus src/fonts in the npm package contract;
• the actual packed npm artifact contains both the software-license and bundled-font license evidence;
• no runtime dependency, service, database, network, credential, model, tenancy, authorization, deployment, retention, or durable-audit authority is introduced.

This is license-file separation and machine-readable supply-chain evidence, not legal advice and not a change to either license.

Test-first lineage

Historical TDD lineage establishes causality only and does not transfer workflow/review acceptance to a later head:

• test-only 961597fe6431452a8ba89d513b6ae236abcc2e9f required exact canonical root MIT text while separately requiring retained Noto/OFL evidence;
• CI 31589849372 failed at the intended root-license assertion because the then-protected root file appended bundled-font terms to the MIT software license while the separate font evidence assertions passed;
• c3ce70a527e19c06e41b7d82d369ee8fd5fa402d removed only the appended bundled-font section from root LICENSE;
• b2c6b6eb7b9638051688939b722a1094c97da013 strengthened manifest/package-source evidence;
• 79c0ca643c012b6666dcbc37cefe16dc3d5575bf added packed-artifact evidence.

The live #270 source/tests remain the implementation authority for this active repair. Do not revive an earlier head or create a competing license writer.

Mandatory live refetch before lifecycle action

Before changing #270 Draft/Ready state, merging it, closing this issue, or using it as release evidence, independently refetch:

1. exact protected main tip and verification;
2. exact fix(supply-chain): separate MIT and bundled-font licenses #270 head and branch ref immediately before mutation;
3. live base, merge base, ahead/behind ancestry, changed paths, and mergeability;
4. live organization/repository rulesets and permissions;
5. all formal reviews and unresolved review threads;
6. every applicable repository and central CI/security/SAST/dependency/package/SBOM/provenance workflow, including each required job's actual checkout SHA/repository identity and whether required action steps executed rather than skipped;
7. any active central owner path for a false-green, wrong-checkout, skipped-required-step, review, or merge-admission defect;
8. current release/tag/registry state owned by release: reconcile Office and npm versions before next stable registry publication #118.

Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, status-only, model-only, wrong-checkout, synthetic-merge-only, or otherwise vacuous evidence is non-passing. Aggregate green is insufficient when an underlying required path did not execute on the submitted exact source.

Integration / operational acceptance boundary

Keep this issue open until #270 integrates under then-live governance and the resulting exact protected generation proves the contract. #118 remains the canonical stable-release operational-acceptance boundary; a release/tag/publication decision must not infer readiness from active-PR metadata.

After protected integration, verify from that exact protected head that:

• GitHub identifies the repository software license as MIT;
• the root/package metadata still agree on MIT software licensing;
• bundled font notices/OFL terms remain present beside the assets;
• the packed and, when applicable, published npm artifact retains both MIT and OFL evidence.

Do not self-approve, transfer predecessor evidence, weaken gates, force-push or destructively rebase, move protected main outside normal governance, fabricate approval/evidence, or substitute a branch ref for release identity.