Add explicit license metadata to @presenton/export-core release

[rixzkiye]

The public v1.0.16 architecture-independent export artifact is named as an open-source package, but I could not locate an explicit license grant for the distributed code.

Artifact checked:

• presenton-export-core-opensource-1.0.16.tgz
• release: https://github.com/presenton/presenton-export/releases/tag/v1.0.16
• SHA-256: 008c97abba83387a1846a113e5c2919390dd80061a70aa7baf85b13e1f2f0571
• package identity: @presenton/export-core@1.0.16

The tarball contains dist/index.js, dist/index.d.ts, package.json, and README.md, but no LICENSE or NOTICE. Its package.json also has no license field, and this repository currently has no detected license.

Could you please publish the applicable license for this exact package, ideally by:

1. adding LICENSE (and NOTICE if required) to the repository and release tarball;
2. adding the matching SPDX identifier to package.json; and
3. confirming whether redistribution of the release tarball in application container images is permitted?

This is currently blocking migration from the older per-architecture v0.4.6 runtime to the v1 architecture-independent package in a downstream Apache-attributed integration.

[rixzkiye]

Follow-up: releases v1.0.17 and v1.0.18 (both published 2026-08-26) still ship without license metadata:

• tarball SHA-256 (presenton-export-core-opensource-1.0.18.tgz, verified against this repo's release asset): f5ad9451e1669530412ea8c28ea60ba080795a6af40704a419ea332979037789
• archive contents remain dist/index.js, dist/index.d.ts, package.json, README.md — no LICENSE/NOTICE
• package.json still has no license field
• the README now references https://github.com/presenton/export-core as the primary release home with a full-feature edition alongside this "opensource" edition, but that repository is not publicly accessible from our side

An explicit grant (LICENSE + SPDX identifier in package.json, plus confirmation that redistribution inside application container images is permitted) would immediately unblock our migration from the legacy v0.4.6 runtime to this architecture-independent core.

[rixzkiye]

Status update (2026-08-27): after auditing v1.0.18 we adopted the "opensource" edition AS-IS — SHA-256-pinned in our build (f5ad9451e1669530412ea8c28ea60ba080795a6af40704a419ea332979037789), invoked through runTask(), with the interpreted-permissive-publication decision and its limits recorded publicly in our third-party notices. This issue stays open purely for the metadata request: an explicit LICENSE/NOTICE + SPDX identifier would still remove the remaining ambiguity, and we'd happily switch the pin to a tagged-with-license release.