chore: cli/LICENSE is MIT (legacy) — should be Apache 2.0 to match repo #2572

The monorepo has two LICENSE files, and they disagree.

Inconsistency:

• Root LICENSE — Apache License 2.0
• cli/LICENSE — MIT License, Copyright (c) 2016 Tom King

Origin: cli/LICENSE is a legacy artifact from when wheels-cli was a separate repository before monorepo consolidation. Tom King's original CommandBox module was MIT; when the CLI was folded into the monorepo, the LICENSE file came along.

Why it matters: SCA tools (Snyk, FOSSA, GitHub dependency graph) scanning subdirectories will classify this monorepo as dual-licensed (Apache-2.0 AND MIT). That's legally ambiguous for downstream consumers. Worse, contributors to cli/ since the merge have been submitting under inbound-equals-outbound assuming Apache 2.0 (since CONTRIBUTING and repo metadata say so), not MIT.

Fix options:

1. Replace cli/LICENSE with a copy of Apache 2.0 + preserve Tom King's copyright in NOTICE for attribution. (Recommended — pairs with the NOTICE file issue.)
2. Delete cli/LICENSE entirely and rely on the root Apache 2.0. Simpler but loses Tom King's copyright assertion entirely.

Option 1 is cleaner and matches Apache 2.0 §4(c)'s NOTICE mechanism.

Tasks:

• Replace cli/LICENSE with Apache 2.0 text
• Capture Tom King's 2016 copyright in NOTICE (or cli/NOTICE)
• Verify no cli/box.json or cli/package.json claims "license": "MIT"

Should ship as part of the broader licensing-hygiene pass.