no license grant anywhere: the published npm package tells an installer nothing, and the control-plane pitch depends on it

[lex00]

@intentius/behold has been published to npm since 0.17.0 with no license
grant anywhere in it. By default that means all rights reserved: anyone who
runs npx @intentius/behold demo has no right to use, copy, modify or
redistribute it, which is the opposite of what the README's control-plane
pitch promises.

What is actually there

• No LICENSE, LICENSE.md or COPYING at the repository root.
• licenses/ holds only vendored third-party terms, not this project's own
  grant: cncf-artwork-LICENSE.md, iTerm2-Color-Schemes-LICENSE,
  kubernetes-icons-LICENSE.
• package.json has no license field.
• No SPDX headers in src/.

What that produced on the registry

name:    @intentius/behold
version: 0.17.0
license: (absent from registry metadata)
published: 2026-09-02T03:38:12Z

npm pack --dry-run on the published package: 136 files, and no license file
among them. So neither the registry page nor the installed tree tells anyone
what they are allowed to do.

What the sibling repos do

Repo	Grant
chant	Apache-2.0, LICENSE at root, and every published package carries "license": "Apache-2.0" (20 of them checked)
fountain-ops	Apache-2.0, LICENSE plus the package.json field
grid	Apache-2.0
choudoufu	MPL-2.0, inherited from OpenTofu and not a free choice

behold is a control plane on chant, so Apache-2.0 matching chant is the
obvious answer unless there is a reason to differ.

Proposed fix

• Add LICENSE (Apache-2.0) at the repository root.
• Add "license": "Apache-2.0" to package.json.
• Add LICENSE to the files array so it ships in the tarball. It is not
  currently listed, and npm only includes a root license file automatically
  when files does not exclude it, so this should be asserted rather than
  assumed. Verify with npm pack --dry-run before the next publish.
• Republish, so the registry metadata stops being blank.

One thing worth deciding at the same time

behold export freezes an estate into a self-contained static folder that
any host can serve. That output embeds the vendored assets in licenses/:
CNCF artwork, the iTerm2 colour schemes vendored into src/themes.js, and
the Kubernetes icons. Whoever serves an exported bundle is redistributing
those, so the export should carry the third-party notices with it rather than
leaving them behind in this repo. THIRD_PARTY.md is already referenced from
the README, so the question is only whether export copies it.

[lex00]

Merged in #407 (c99df55): Apache-2.0 declared, shipped and carried by export. Released as @intentius/behold@0.18.0, which the registry now lists with license: Apache-2.0.