contractiles: add README SPDX header; make no-pmpl probe header-form only

- README.adoc gains its SPDX-License-Identifier: CC-BY-SA-4.0 header (was missing)
- no-pmpl-outside-carveout probe now checks head -8 (header-form) and excludes
  LICENSES/, fixing two false positives (the probe self-matching its own grep
  string, and the PMPL-1.0-or-later.txt licence text)

Author: claude

.machine_readable/contractiles/must/Mustfile.a2ml

@@ -70,8 +70,9 @@ requirements — CI and pre-commit hooks fail if any check fails.
 
 ### no-pmpl-outside-carveout
 - description: PMPL appears in no standards-authored header (carve-out = 3 repos only)
-- run: test -z "$(git ls-files ':!:consent-aware-http/**' ':!:*palimpsest*' | xargs grep -lm1 'SPDX-License-Identifier: PMPL' 2>/dev/null)"
+- run: test -z "$(git ls-files ':!:consent-aware-http/**' ':!:*palimpsest*' ':!:LICENSES/**' | while read -r f; do head -8 "$f" 2>/dev/null | grep -qm1 'SPDX-License-Identifier: PMPL' && echo "$f"; done)"
 - severity: critical
+- notes: Header-form only (head -8); LICENSES/ text and deep example mentions are not headers.
 
 ### policy-no-contradiction
 - description: LICENCE-POLICY.adoc and licensing-policy.toml agree (both name CC-BY-SA-4.0)

README.adoc

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
 = Hyperpolymath Standards
 
 image:https://img.shields.io/badge/License-MPL--2.0-blue.svg[License: MPL-2.0,link="https://www.mozilla.org/MPL/2.0/"]