#3326 Registry: validate, record and score the declared license (optional; remove the swamp-club license setting)

Part 4 of 6 of the extension license requirement (#3323–#3328). Plan: Extension license proposal (https://claude.ai/code/artifact/8c256b86-ce33-4898-8b70-223ec3b827f2). Depends on #3324 being released and #3 merged.

Change (swamp-club registry)

• Confirm: validate license with the same rules as the CLI, and require a LICENSE file in the archive for public versions. Store it on the version. Refuse a new public version without it, with an error that says to add license: and upgrade the CLI if needed. Private versions may omit it.
• Private to public: the website toggle and POST /api/v1/extensions/<name>/public are refused unless the latest version declares a license.
• Rubric: has-license comes from the version's declared field. has-license needs both the declared field and a LICENSE file. The registry setting no longer counts.
• Remove the registry license setting. Remove the license input from the Scorecard owner panel (islands/ScorecardOwnerPanel.tsx), and stop PATCH /api/v1/extensions/<name> from setting license: refuse it, with an error that points to the manifest field. The extension-level license in API responses becomes the latest version's declared license, derived rather than stored, so the CLI's info keeps working. Clear the stored settings in a migration. Only 2 extensions use the setting today.
• Display: the extension page, /api/v1/extensions/<name> and the version history show the declared license per version.
• A UAT item covers: confirm refusal, the public toggle refusal and the scorecard.

Decided (Seth, 2026-10-13)

Older CLIs are refused at publish once this ships. The refusal tells them to upgrade first (see below).

Refusal for older clients (Seth, 2026-10-13)

Clients that predate #3324 never send license (they drop unknown manifest keys), so they only ever see the registry's refusal. A new CLI refuses locally first.

• Where: refuse at the start of the push request, before the archive uploads, not at confirm. No upload, and no half-published version left behind.

• Status: 422, with the whole message in error. Released CLIs print error (plus reason) exactly as written for 403, 409 and 422. Any other status gets wrapped as Extension API error (HTTP n): … [url].

• Message. Upgrading comes first, because adding license: alone won't help an old CLI:

  This version can't be published: public extensions must declare a license. Upgrade swamp (swamp update; version <first release with #3324> or later is required), then add license: <SPDX id> to your manifest and include a LICENSE file with the license text. Private extensions don't need a license. See <manual page from #3328>

  Fill in the version once #3324 releases, and the address once #3328 writes the page.

Acceptance (added)

• A public push without license is refused with 422 at push start, with the message above. Nothing is uploaded and no version record is created.
• UAT: a released swamp from before #3324 pushing a public extension prints exactly that message. Use the pinned old release the license UAT already uses.

Re-scoped 2026-10-13 (Seth and the team): the license is OPTIONAL

This section overrides anything above that conflicts with it.

• Drop every refusal: no 422 at push, no gate on the private-to-public switch, no refusal at publish or promote. The old-client refusal text above is withdrawn.
• Keep: validate the declared expression (invalid warns, earns no points; only SPDX ids count), store it per version, show it on the extension page and in the API, derive the extension-level license from the latest version.
• Remove the swamp-club license setting (the Scorecard owner panel box and PATCH license), as before.
• Scorecard: two items, one point each: (1) a valid SPDX license declared in the manifest; (2) a LICENSE file in the archive. Same as the CLI (#3324).
• Hiding is gone (#3397), so there are no hiding-rule changes here.
• UAT: change the refusal scenarios to 'publishes, scorecard shows the factor missing'.