feat: prepare CASAN paid PoC release package

docs/commercial/LICENSE_AND_IP_DECISION.md

@@ -0,0 +1,44 @@
+# CASAN Commercial License and IP Decision
+
+## Decision
+
+CASAN is offered as **proprietary commercial software**. No rights to use,
+copy, modify, distribute, host, or sublicense CASAN are granted except under a
+written evaluation, PoC, subscription, or enterprise agreement signed by the
+copyright owner and the customer.
+
+For a paid PoC, the default grant is a non-exclusive, non-transferable,
+time-limited right to deploy the delivered CASAN bundle in the customer’s
+approved environment for the agreed evaluation scope. Production use, managed
+service operation, redistribution, and source access require separate terms.
+
+This decision applies to CASAN-authored material only. It does not override
+third-party license obligations.
+
+## Release controls
+
+1. Regenerate `THIRD_PARTY_SOFTWARE.json` from the committed lockfile before
+   each paid-PoC or release candidate: `node scripts/generate-license-inventory.mjs`.
+2. Review every `UNKNOWN`, copyleft, source-available, model, dataset, font,
+   icon, container-base-image, or copied-script license before shipment.
+3. Include required notices and source-offer material in the release bundle
+   whenever a dependency license requires it.
+4. Record the review owner, release version, decision, and exceptions in the
+   release Evidence Pack or legal review record.
+5. Do not claim ownership of customer source code, prompts, or Evidence Pack
+   data; ownership and permitted processing are defined by the customer
+   agreement and data-processing terms.
+
+## Known scope boundary
+
+The generated inventory is complete for root-lockfile npm packages only. It is
+not proof that Python tooling, operating-system packages, Docker base images,
+models, datasets, or bundled assets are cleared. Those sources are release
+blockers until separately inventoried and approved.
+
+## Required legal review before external sale
+
+Confirm copyright ownership/assignment for CASAN-authored code, trademark use,
+customer contract templates, export-control applicability, open-source notices,
+and country-specific privacy terms. This document records the product decision;
+it is not a substitute for counsel.

docs/commercial/LICENSE_EXCEPTIONS.json

@@ -0,0 +1,16 @@
+{
+  "schema_version": "1.0",
+  "purpose": "Manual license-review findings for packages whose committed lockfile does not contain license metadata.",
+  "exceptions": {
+    "busboy@1.6.0": {
+      "reviewed_license": "MIT",
+      "evidence": "https://github.com/mscdex/busboy/blob/master/LICENSE",
+      "review_status": "requires-release-notice"
+    },
+    "streamsearch@1.1.0": {
+      "reviewed_license": "MIT",
+      "evidence": "https://github.com/mscdex/streamsearch/blob/master/LICENSE",
+      "review_status": "requires-release-notice"
+    }
+  }
+}