fix(license): restore canonical Apache 2.0 LICENSE + add NOTICE

[KaluJo]

Summary

GitHub shows the cli repo's license as "Other" instead of
Apache-2.0 because LICENSE contains dozens of substantive wording
deviations from the canonical text — the kind of drift you get from
running an Apache 2.0 file through a reformatter at some point. This
PR replaces it with the verbatim upstream text and moves the
project's actual copyright assertion into a dedicated NOTICE file.

Root cause

diff of the previous LICENSE against
apache.org/licenses/LICENSE-2.0.txt
surfaces wording changes like:

Canonical Apache 2.0	Previous cli/LICENSE
\"Contribution\" shall mean any work	\"Contribution\" shall mean, as defined in Section 5, any work
consequential damages	exemplary damages
Accepting Warranty or Additional Liability	Accepting Warranty or Liability
you may act only on Your own behalf	you may offer such obligations only on Your own behalf
APPENDIX: How to apply the Apache License... (full section)	(entirely missing)

GitHub's license detector (Licensee)
needs a high-similarity match against canonical SPDX text and
correctly fell back to NOASSERTION ("Other") for this file:

$ gh api repos/pcr-developers/cli --jq '.license'
{\"key\":\"other\",\"name\":\"Other\",\"spdx_id\":\"NOASSERTION\",\"url\":null}

Beyond the detection issue, the deviations are a real legal-hygiene
problem: a reformatted Apache 2.0 is not Apache 2.0, it's a license
that looks like it. Anyone reading LICENSE was getting a slightly
different agreement than the one declared by Cargo.toml's
license = \"Apache-2.0\" SPDX identifier.

What this PR does

1. Replaces LICENSE with the verbatim
   https://www.apache.org/licenses/LICENSE-2.0.txt (11,358 bytes,
   202 lines, byte-identical to upstream).

2. Adds a NOTICE file that carries the project's copyright
   assertion (Copyright 2026 PCR.dev). This is the location
   defined by Apache 2.0 §4(d):

   If the Work includes a "NOTICE" text file as part of its
   distribution, then any Derivative Works that You distribute must
   include a readable copy of the attribution notices contained
   within such NOTICE file...

   The NOTICE pattern keeps the LICENSE file detectable AND
   preserves attribution properly. Most major Apache-licensed
   projects use this split (kubernetes, terraform, hashicorp tools,
   ASF projects).

Verification

$ diff <(curl -s https://www.apache.org/licenses/LICENSE-2.0.txt) LICENSE
# (no output — byte-identical)

$ wc -lc LICENSE
     202   11358 LICENSE

After this lands on main, GitHub re-scans within a few minutes and
the repo sidebar should flip from "Other" to "Apache-2.0". I'll
verify post-merge.

Out of scope

• homebrew-pcr/LICENSE currently detects as MIT on GitHub
  despite obviously containing Apache 2.0 text — that's a separate
  detection quirk (probably due to a stray pattern Licensee
  fingerprints). Tracking that for a follow-up; this PR focuses on
  the cli repo since that's the user-facing one with Cargo.toml
  and package.json declaring Apache-2.0.
• Cargo.toml already has license = \"Apache-2.0\" (valid SPDX),
  same for crates/pcr-napi/package.json — no changes needed.

Test plan

• diff against upstream returns empty
• LICENSE size matches upstream exactly (11358 bytes)
• NOTICE reads as a proper attribution file (not a license)
• Post-merge: GitHub re-detects as Apache-2.0 (will verify
  via gh api repos/pcr-developers/cli --jq '.license')

Made with Cursor