licensing: @cartesi/rollup redistributes Apache-2.0 libcmt sources without their LICENSE

[brunomenezes]

Summary

@cartesi/rollup ships libcmt's C sources in its npm tarball and compiles them into the addon, but its files array pulls in include/** and src/** only — not the submodule's LICENSE.

Evidence

packages/rollup/package.json:

"files": [
  "binding.gyp",
  "dist/**",
  "native/addon.cc",
  "prebuilds/**",
  "deps/machine-guest-tools/sys-utils/libcmt/include/**",
  "deps/machine-guest-tools/sys-utils/libcmt/src/**"
]

Upstream cartesi/machine-guest-tools is Apache-2.0 (verified against its LICENSE).

Why it matters

Apache-2.0 §4(a)/(d) asks a redistributor to include the licence and propagate any NOTICE with the derivative work. This is Cartesi-owned code, so there is no outside rights-holder to answer to — but the missing notice is visible to everyone who unpacks the tarball, and it is exactly the sort of thing an auditor's diligence review flags.

Acceptance criteria

• Add deps/machine-guest-tools/LICENSE (and NOTICE if present) to packages/rollup's files
• Document the libcmt attribution in packages/rollup/README.md
• Confirm via npm pack --dry-run that the licence file is present in the tarball
• Coordinate with licensing: No published package ships a LICENSE #169 so both land in the same release

Files likely touched

• packages/rollup/package.json
• packages/rollup/README.md