feat: Module Package v1 carries the module's own license (ADR 0051)

Every Module Package v1 now declares the module's license and carries its
text. packageFormat stays 1; pre-ADR-0051 metadata fails closed.

- Contracts: ekklesia.package.json requires an SPDX `license` expression,
  validated with spdx-expression-parse, with UNLICENSED and non-expressions
  refused. The `files` list must hold exactly one non-empty root LICENSE.
  The package contracts move to the @ekklesia/contracts/module-package
  subpath, so the SPDX parser and its data (spdx-exceptions and
  spdx-license-ids ship no licence files) never reach a module bundle
  through the SDK's re-export of the contracts root.
- Packager: reads the source package.json's string SPDX declaration and
  never invents one. It requires an explicit --license-file (a non-empty
  regular file, no symlink, no parent search, no download) and copies its
  bytes unchanged to LICENSE, listed with size and SHA-256 and covered by
  the archive digest. THIRD_PARTY_NOTICES stays third-party only, and
  bundled Ekklesia code stays in `incorporates`.
- Verifier: rejects missing or invalid license metadata, and a missing,
  unlisted, duplicated, or corrupted LICENSE, through the schema and the
  existing strict inventory.
- Template: packaged as AGPL-3.0-or-later with the repository's canonical
  LICENSE, passed explicitly (Dockerfile, smoke, docs). Packing it twice
  gives byte-identical archives.

Started by Codex; reviewed and completed in Claude Code (empty license-text
refusal, schema non-empty LICENSE, symlink and empty-file tests).

ADR 0051 is Accepted.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-pack/tests/support/fixture-module.ts

@@ -24,6 +24,8 @@ export interface FakePackage {
 export interface FixtureModuleOptions {
   readonly databaseAbi?: 1;
   readonly id?: string;
+  readonly license?: unknown;
+  readonly licenseText?: string | Uint8Array;
   readonly version?: string;
   readonly serverSource?: string;
   readonly withModuleDatabase?: boolean;
@@ -114,6 +116,7 @@ export async function fixtureModule(options: FixtureModuleOptions = {}): Promise
       {
         name: `@test/module-${id}`,
         version,
+        license: Object.hasOwn(options, "license") ? options.license : "MIT",
         private: true,
         type: "module",
         scripts: { build: "tsc" },
@@ -130,6 +133,10 @@ export async function fixtureModule(options: FixtureModuleOptions = {}): Promise
       2,
     )}\n`,
   );
+  await write(
+    path.join(moduleDirectory, "LICENSE"),
+    options.licenseText ?? "MIT License\n\nCopyright (c) 2026 Example Module\n",
+  );
   await write(
     path.join(moduleDirectory, "dist/server/index.js"),
     options.serverSource ?? defaultServer(id, version, options.databaseAbi),