feat: Module Package v1 carries the module's own license (ADR 0051)

Every Module Package v1 now declares the module's license and carries its
text. packageFormat stays 1; pre-ADR-0051 metadata fails closed.

- Contracts: ekklesia.package.json requires an SPDX `license` expression,
  validated with spdx-expression-parse, with UNLICENSED and non-expressions
  refused. The `files` list must hold exactly one non-empty root LICENSE.
  The package contracts move to the @ekklesia/contracts/module-package
  subpath, so the SPDX parser and its data (spdx-exceptions and
  spdx-license-ids ship no licence files) never reach a module bundle
  through the SDK's re-export of the contracts root.
- Packager: reads the source package.json's string SPDX declaration and
  never invents one. It requires an explicit --license-file (a non-empty
  regular file, no symlink, no parent search, no download) and copies its
  bytes unchanged to LICENSE, listed with size and SHA-256 and covered by
  the archive digest. THIRD_PARTY_NOTICES stays third-party only, and
  bundled Ekklesia code stays in `incorporates`.
- Verifier: rejects missing or invalid license metadata, and a missing,
  unlisted, duplicated, or corrupted LICENSE, through the schema and the
  existing strict inventory.
- Template: packaged as AGPL-3.0-or-later with the repository's canonical
  LICENSE, passed explicitly (Dockerfile, smoke, docs). Packing it twice
  gives byte-identical archives.

Started by Codex; reviewed and completed in Claude Code (empty license-text
refusal, schema non-empty LICENSE, symlink and empty-file tests).

ADR 0051 is Accepted.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/development/testing.md

@@ -598,26 +598,31 @@ CI / migration-smoke (pull_request)
 
 Ekklesia Module Package v1 (ADR 0049) is proven at three levels, all in `pnpm verify`:
 
-- `packages/contracts/tests/module-package.test.ts`: the `ekklesia.package.json` schema, target
-  names, and the generated runtime `package.json`.
+- `packages/contracts/tests/module-package.test.ts`: the `ekklesia.package.json` schema, required
+  SPDX expression and `LICENSE` inventory entry, target names, and the generated runtime
+  `package.json`.
 - `core/tests/module-package-verification.test.ts`: the verifier against hand-built archives,
   including what the packager never produces. A valid package verifies and extracts with normalized
   modes. A wrong digest, a corrupted or missing or unlisted file, disagreeing identities, an unknown
   format, unknown transitional metadata, an incompatible target, Node.js range, SDK, or legacy
   database runtime, ABI metadata carrying a forbidden transitional runtime, malformed ABI schema
-  metadata, a missing entrypoint, a backend that imports something the package lacks, absolute and
+  metadata, missing or malformed license metadata, missing, unlisted, duplicated, or corrupted
+  `LICENSE`, a missing entrypoint, a backend that imports something the package lacks, absolute and
   `..` paths, symbolic and hard links, device nodes and FIFOs, setuid and setgid entries, a second
   top-level directory, and a duplicate entry each fail with their own sanitized code. The backend
   load check runs in a real child process and selects the schema contract from the manifest.
 - `packages/module-pack/tests/`: the packager against generated fixture modules (payload contents,
   generated `package.json`, metadata, bundled backend with only built-in imports, refusal of native
-  and platform-specific dependencies and of unknown or textless licences, notices, byte-identical
-  archives, normalized tar and gzip headers), and end to end against the built module template:
+  and platform-specific dependencies and of unknown or textless third-party licences, explicit
+  module SPDX and license-file validation, unchanged `LICENSE` bytes and inventory digest, notices,
+  byte-identical archives, normalized tar and gzip headers), and end to end against the built module template:
   packed twice to identical bytes without changing the workspace's install state, verified by Core's
   verifier with a deliberately different Core Drizzle version, extracted elsewhere, and loaded with
   Node's own resolution hooks proving nothing outside the package is resolved. The package contains
-  module-side Drizzle but no `transitional.databaseRuntime`. Turbo builds the template and Core
-  first, and runs the template's own tests (which rebuild its UI in place) before these.
+  the repository's exact AGPL `LICENSE`, authoritative `AGPL-3.0-or-later` metadata, module-side
+  Drizzle but no `transitional.databaseRuntime`, and no tooling-only SPDX parser dependency. Turbo
+  builds the template and Core first, and runs the template's own tests (which rebuild its UI in
+  place) before these.
 
 ## The generic platform image and the reference deployment
 
@@ -636,8 +641,9 @@ These need Docker and build images locally; nothing is pushed or published.
 - `pnpm deploy:smoke` (`scripts/smoke-deploy.sh`) runs the reference deployment end to end on the
   generic image with empty module storage. With `EKKLESIA_SMOKE_TOPOLOGY=split`, the same image also
   runs the installed-module lifecycle:
-  - the module template is packaged by the canonical packager (Module Package v1, ADR 0049),
-    as ABI v1, verified by the image's own verifier, and installed into module storage;
+  - the module template is packaged by the canonical packager (Module Package v1, ADR 0049 and
+    ADR 0051), with its explicit AGPL declaration and license bytes, as ABI v1, verified by the
+    image's own verifier, and installed into module storage;
   - its migration is planned and explicitly applied, and the API restarted;
   - a real browser mounts it;
   - it is removed and the API restarted, and Core still runs, migrations still plan and apply, and