chore(license): actually delete the proprietary fonts and unused packages

The audit has claimed since 2026-07-23 that these were git-rm'd. They weren't —
only the web/dist copies went, and all of them were still tracked at HEAD nearly
three weeks later, in a repo about to be published under MIT.

Deleted (~40.7 MB):
  neode-ui/public/assets/fonts/Courier_New/{CourierNew-Bold,CourierNew-Regular}.ttf
  neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf
  neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf
  neode-ui/public/packages/wireguard.apk   (17 MB)
  neode-ui/public/packages/atob.s9pk       (23 MB)

Courier New is Monotype proprietary and Benton Sans is a commercial Font Bureau
typeface — neither is redistributable. wireguard.apk carries GPL-2.0 libwg
components, so shipping it triggers a source offer. atob.s9pk is a Start9
package of unknown license. Redacted's upstream is OFL-1.1 but no license text
was shipped; deleting was cheaper than sourcing it, since it was unused.

Verified unreferenced before deleting, not after:
- Every @font-face rule in the tree (2 in src/style.css, 2 in
  public/entropy/index.html) loads Montserrat. None of these files was ever
  loaded by CSS.
- The three `Courier New` hits (tailwind.config.js `mono`, two public HTML
  font-family lists) name the *system* font as a fallback — they are not
  @font-face sources, so rendering is unchanged.
- wireguard.apk and atob.s9pk have zero references in any tracked file.
- These live under neode-ui/public/, which Vite copies verbatim rather than
  resolving, so their absence cannot break a build.

Deliberately kept: neode-ui/public/packages/archipelago-companion.apk, which IS
live (staged by .githooks/pre-push, the Android release flow, and the in-app
pairing QR); Montserrat (OFL.txt) and Open Sans (LICENSE.txt), both properly
licensed; and neode-ui/test-install.sh, which the same audit line listed but
which is not a licensing concern.

Audit updated: §1 and §3's font/package items marked closed, the false DONE
entry rewritten as a history note rather than deleted — a DONE line here is a
claim and should be re-verified with git ls-tree, which is exactly the lesson.
§2 (zbase32, LGPL-3.0+) is now the last hard blocker.

Side effect: ~40 MB off the frontend OTA tarball.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/LICENSE-COMPLIANCE-AUDIT.md

@@ -4,8 +4,10 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/
 
 **Verdict (as of the 2026-07-22 audit):** the dependency graph is almost entirely permissive (MIT/Apache/BSD) and compatible with a free open-source release. But the repo was not releasable as-is: it had **no license of its own**, one **LGPL Rust dependency**, several **non-redistributable committed assets** (proprietary fonts, unknown-rights media), and **missing attribution machinery**. Everything below is ordered by severity.
 
-> **The licence blocker is closed** — root `LICENSE` (MIT) and `NOTICE` are in the
-> tree. **Two blockers are still open**, see the corrected status below.
+> **Updated 2026-08-08.** §1 (no license) and §3 (non-redistributable committed
+> files) are now **closed** — root `LICENSE` (MIT) + `NOTICE` are in the tree, and
+> the proprietary fonts and unused packages have actually been deleted. **§2
+> (`zbase32`, LGPL-3.0+) is still open** and is the last hard blocker.
 
 ---
 
@@ -13,29 +15,28 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/
 
 **DONE:**
 - MIT adopted. Root `LICENSE` + `NOTICE` added; `license = "MIT"` in all 5 workspace crates (archy-fips-core already had it); `"license": "MIT"` (+ `"private": true`) in all 4 package.json files.
-- ~~Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`; `atob.s9pk`; obsolete `test-install.sh` (all git-rm'd; also removed from `web/dist`).~~
-  **⚠️ NOT DONE — corrected 2026-08-08.** All seven are still tracked at HEAD and
-  present on disk. Only the `web/dist` copies were removed; the sources never were:
+- Deleted: `Courier_New/`, `Benton_Sans/`, `Redacted/` fonts; `wireguard.apk`;
+  `atob.s9pk`.
+
+  **History note (2026-08-08):** this line originally claimed all of these plus
+  `test-install.sh` were "git-rm'd" on 2026-07-23. They were not — only the
+  `web/dist` copies had been removed, and all seven sources were still tracked at
+  HEAD nearly three weeks later. The six listed above were actually deleted on
+  2026-08-08 (`neode-ui/test-install.sh` was left; it is not a licensing
+  concern). Kept as a reminder that a DONE entry here is a claim, not evidence —
+  re-verify with:
 
   ```
-  neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf   # Font Bureau, commercial
-  neode-ui/public/assets/fonts/Courier_New/CourierNew-Bold.ttf      # Monotype, proprietary
-  neode-ui/public/assets/fonts/Courier_New/CourierNew-Regular.ttf   # Monotype, proprietary
-  neode-ui/public/assets/fonts/Redacted/redacted.regular.ttf
-  neode-ui/public/packages/atob.s9pk                                # 23 MB
-  neode-ui/public/packages/wireguard.apk                            # 17 MB
-  neode-ui/test-install.sh
+  git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'
   ```
 
-  Verify with `git ls-tree -r HEAD --name-only | grep -iE 'Courier_New|Benton_Sans|Redacted/|wireguard.apk|atob.s9pk'`.
-
-  **This is still a release blocker**: shipping proprietary Monotype and Font
-  Bureau typefaces in an MIT-licensed public repo is exactly what §3 says must
-  not happen. Deleting them is safe — nothing references the font *files* (the
-  three `Courier New` hits are CSS `font-family` fallbacks naming the system
-  font, not `@font-face` sources), and `wireguard.apk` / `atob.s9pk` have zero
-  references anywhere in the tree. Removing the two packages also takes 40 MB
-  off the frontend OTA tarball.
+  Deletion was safe: no `@font-face` rule ever referenced them (all four in the
+  tree load Montserrat), the `Courier New` hits in `tailwind.config.js` and two
+  public HTML files are `font-family` fallbacks naming the *system* font, and
+  `wireguard.apk` / `atob.s9pk` had zero references anywhere. Montserrat (OFL.txt)
+  and Open Sans (LICENSE.txt) remain, as does the actively-used
+  `archipelago-companion.apk`. Removing the two packages also took ~40 MB off
+  the frontend OTA tarball.
 - Media provenance resolved: all demo music/photos/posters, UI sfx, backgrounds, and intro video are the author's original work — recorded in `demo/content/README.md` and `NOTICE`.
 - Meshtastic device artwork attributed (`mesh-devices/ATTRIBUTION.md` + NOTICE); icon attribution added (`assets/icon/ATTRIBUTION.md`: game-icons.net CC BY 3.0, pixelarticons MIT).
 - Reticulum decision: include + disclose (NOTICE states the Reticulum License restrictions and that it applies only to the optional daemon).
@@ -57,7 +58,9 @@ Audit date: 2026-07-22. Scope: entire repo (core Rust workspace, neode-ui, apps/
 
 ---
 
-## 1. BLOCKER — the project has no license
+## 1. BLOCKER — the project has no license  ✅ CLOSED
+
+_Resolved: MIT adopted, root `LICENSE` + `NOTICE` present. Original finding below._
 
 There is no `LICENSE`/`COPYING` file anywhere in the repo. No crate in `core/` declares a `license` field; none of the four `package.json` files do either (and the three `apps/*` packages aren't even `private: true`). Until fixed, the code is "all rights reserved" — publicly visible, but legally not open source and not usable by anyone.
 
@@ -73,14 +76,14 @@ There is no `LICENSE`/`COPYING` file anywhere in the repo. No crate in `core/` d
 
 No GPL, AGPL, SSPL, or unlicensed crates exist anywhere else in the Rust graph. (`r-efi` and `self_cell` list LGPL/GPL only as options in OR-expressions — elect MIT/Apache, no action.)
 
-## 3. BLOCKER — committed files we may not redistribute
+## 3. BLOCKER — committed files we may not redistribute  ◐ fonts/packages CLOSED 2026-08-08; media + redis items still open
 
-Remove from git (and **purge from history** before the repo goes public — they're in past commits):
+Remove from git (history purge is **moot** — the launch plan is a fresh-history publish, so past commits are not carried over):
 
-- [ ] `neode-ui/public/assets/fonts/Courier_New/` — Monotype proprietary font, no license, **unused in CSS**. Delete.
-- [ ] `neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf` — commercial Font Bureau typeface, no license, unused. Delete.
-- [ ] `neode-ui/public/packages/wireguard.apk` (17 MB) — official WireGuard Android APK containing GPL-2.0 `libwg` components; redistribution triggers GPL source-offer. **Unreferenced since the FIPS migration** — delete.
-- [ ] `neode-ui/public/packages/atob.s9pk` (24 MB) — Start9 service package, unknown license, referenced only by a test script. Delete.
+- [x] `neode-ui/public/assets/fonts/Courier_New/` — Monotype proprietary font, no license, **unused in CSS**. ~~Delete.~~ **DELETED 2026-08-08.**
+- [x] `neode-ui/public/assets/fonts/Benton_Sans/BentonSans-Regular.otf` — commercial Font Bureau typeface, no license, unused. ~~Delete.~~ **DELETED 2026-08-08.**
+- [x] `neode-ui/public/packages/wireguard.apk` (17 MB) — **DELETED 2026-08-08.** — official WireGuard Android APK containing GPL-2.0 `libwg` components; redistribution triggers GPL source-offer. **Unreferenced since the FIPS migration** — delete.
+- [x] `neode-ui/public/packages/atob.s9pk` (24 MB) — **DELETED 2026-08-08.** — Start9 service package, unknown license, referenced only by a test script. Delete.
 - [ ] `demo/content/music/` (18 full tracks, ~150 MB) and `demo/peer-media/` (17 photos/book covers/film posters) — no recorded rights. If they're your own/AI-generated work, document that in a `demo/content/README`; otherwise remove.
 - [ ] `neode-ui/public/assets/video/video-intro.mp4`, `Kratter.MP3`, photographic `bg-*.jpg` backgrounds, UI/arcade sound effects in `assets/audio/` — same: document provenance (user-made per project convention) or replace. `welcome-noderunner.mp3` is ElevenLabs TTS — their commercial-use terms allow this on paid plans; note it.
 - [ ] **Registry: `redis:7.4.8`** (`scripts/image-versions.sh` `REDIS_IMAGE`) — Redis ≥ 7.4 is RSALv2/SSPLv1, **not open source**; re-hosting it on your registry is redistribution under a restricted license. **Switch to Valkey** (BSD-3, already mirrored) everywhere.
@@ -89,7 +92,7 @@ Remove from git (and **purge from history** before the repo goes public — they
 
 - [ ] **`neode-ui/public/assets/img/mesh-devices/` (36 SVGs)** — almost certainly Meshtastic project device artwork (meshtastic/web is GPL-3.0). Confirm source; either replace with original art or comply with the upstream license + attribution.
 - [ ] **`neode-ui/public/assets/icon/`** — `barbarian.svg`, `batteries.svg` match game-icons.net (**CC BY 3.0 — visible attribution required**); pixel-style icons match pixelarticons (MIT). Confirm and add attribution, or replace.
-- [ ] `Redacted/redacted.regular.ttf` — upstream is SIL OFL 1.1 but no license file is shipped. Add `OFL.txt` or delete (unused).
+- [x] `Redacted/redacted.regular.ttf` — upstream is SIL OFL 1.1 but no license file is shipped. ~~Add `OFL.txt` or delete (unused).~~ **DELETED 2026-08-08** (unused; deleting was cheaper than sourcing the OFL text).
 - [ ] **indeedhub** — submodule (private gitea) not checked out; no known license, yet `indeedhub{,-api,-ffmpeg}:1.0.0` images are distributed via registry/ISO. `indeedhub-ffmpeg` implies a bundled FFmpeg (LGPL/GPL → source-offer obligations). Must license the project and audit the ffmpeg build before public release.
 - [ ] `minmoto/fmcd` v0.8.0 and `ark-bitcoin/bark` (barkd) — binaries redistributed in your images; verify upstream licenses (bark claims Apache-2.0/MIT dual) and include their notices.
 - [ ] **Start9/StartOS heritage** — `core/{js-engine,container-init,models,helpers}` are StartOS-derived (embassy paths, s9pk handling). start-os is MIT → attribution required if kept. **Better: delete these four crates** — they are not workspace members, cannot compile (broken `../../patch-db` path dep), and carry an unpinned `yajrc = "*"` git dep on a moving branch. Deleting removes both the attribution question and dead code.