Adopt EUPL-1.2: canonical LICENSE, SPDX headers on all Python files, CI gate

[sumerjohal]

Why

• The existing LICENSE was silently truncated: exactly the first 134 lines of MPL-2.0, ending mid-sentence in §2.4. The copyleft core (§3), termination terms and Exhibits were absent, and GitHub reported the repository as NOASSERTION — the first signal any would-be forker checks.
• Even intact, MPL-2.0 (and GPL) trigger only on distribution. AR2 nodes are operated as services; a closed, modified fork run as a hosted service would owe nothing. EUPL-1.2's copyleft attaches to "providing access to its essential functionalities" (§1, §5), so hosted forks are bound too. It is Commission-authored, OSI-approved, and carries equal force in 23 EU languages — the operating environment of the node network (EUDR, EUDI wallets, dataspaces).
• Goal: one standard implementation; modifications must be contributed back, not proliferated as closed variants.

What

• LICENSE replaced with the canonical EUPL-1.2 English text (byte-for-byte, sha256-pinned).
• SPDX header (SPDX-License-Identifier: EUPL-1.2) on all 45 tracked Python files — one uniform rule, no exceptions.
• scripts/license_check.sh: hash-verifies the LICENSE and greps every tracked .py for the header. Wired into ci.yml as a gating job, so a future truncation or unheadered file fails loud instead of silently.
• Lesson recorded in .stomata/lessons.json under license-posture-unchecked (the pinned harness predates stomata lesson add, so the ledger was edited directly in its existing schema).

Before merging

• Relicensing consent: all contributions to date must be from parties who assent to the change from the (truncated) MPL declaration. If every contributor is core team, an acknowledgment in this PR thread suffices — collect it now, before external PRs make this a consent-gathering exercise.
• AgStack TAC / Linux Foundation sign-off: a copyleft license is a departure from the LF Apache-2.0 default; confirm the project charter permits it.
• Companion PRs in ar2-hub and pancake (pancake also fixes the GOVERNANCE.md/README "Apache 2.0" declarations that contradicted its missing LICENSE).

Lint (ruff check app|migration --ignore E402) passes locally with the headers in place.

[sumerjohal]

The failing test and gate jobs here are pre-existing on main, not caused by this change: every committed grant fixture (valid/revoked/tampered/wrong_geoid.sdjwt) expired on 2026-08-20, so four tests fail on any branch opened this week -- and the tamper/revocation tests have been passing vacuously since then. Fixed in #18 (with agstack/pancake#8). Merge #18 first, then re-run CI here; the license job this PR adds is already green.