licensing-reviewlisted

The always-on prohibitions live in the selected `licensing` stance. Resolve its shared source with `citizen stances --json`; runtime projections carry the same policy. This is the procedure. ## Before adopting or upgrading 1. **Read the authoritative license**, not the marketplace blurb or the README badge. Check the exact version you are taking. 2. **Inspect the actual package**, including transitive dependencies and any separately licensed textures, data, fonts or bundled code inside it. 3. **For dual licensing**, record which qualifying option you are taking. Where terms are combined rather than alternative, all of them must comply. 4. **Check authorship and provenance.** An uploader's claim does not establish ownership. Reject game rips, unlicensed copies, and anything with missing, conflicting or suspect rights. 5. **Recheck on upgrade.** Terms change between versions. Pin a floor you have actually run against. 6. **No new third-party dependency without a reason the reviewer will accept.** In a shared repo that means an issue or a note in the PR; in a solo repo it means one sentence in the commit. If nothing compliant fits, adapt a compliant base or create original work. Do not weaken the policy to use a download. Catalog availability is not asset clearance. ## Record it Every incorporated component goes in the project's third-party manifest with: - Source URL - Creator or rightsholder - Exact version, or asset hash - License identifier, and