[flexdinesh]

• Audited every license: the root LICENSE (MIT), all workspace manifests, linked Go modules (go list -deps -test), all pnpm deps (pnpm licenses list -r), and the Shiki grammar/theme chunks bundled into internal/webui/dist.
• docs-website/package.json: added "license": "MIT". It was the only workspace package without one.
• docs/release.md: new "Licensing" section listing the accepted exceptions:
  • The embedded bundle ships GPL-3.0 Shiki grammars (ada, nginx, org, racket, ahk2) and theme (aurora-x), MPL-2.0 grammars (hcl, terraform, bird2), and about 30 grammars with no detectable license. All were kept by decision.
  • @codesandbox/nodebox (Sustainable Use License) comes in through vocs, is only used to build the docs, and is absent from the published site (dist/public) and from releases.
  • Build tooling that never ships: MPL-2.0 lightningcss, CC-BY-4.0 caniuse-lite, Python-2.0 argparse.
• All Go modules and runtime npm deps are permissive (MIT, BSD, ISC, Apache-2.0, 0BSD, BlueOak). The font is OFL-1.1.

Validation:

• mise run check: test:js failed under parallel load. The plugin-pi test "agent host can exit while detached sync scheduling remains alive" hit its 750ms spawn timeout, which is pre-existing flakiness unrelated to this change.
• Run serially, every suite passes: check:ci, test:contracts:rules, docs:check, test:js (114 browser tests plus unit tests), test:release, test:go.