chore(license): remove accidental MIT claim, add OSQP attribution

[adilfaisal01]

What

Two independent problems, both verified against current main:

1. The repo declares an MIT license it never chose.
pyproject.toml carried license = { text = "MIT" } with no LICENSE file anywhere in history. It was emitted as packaging boilerplate during an Aug 2026 packaging refactor, not a decision.

A license field with no license text asserts terms the repo does not ship — and on a public repo, a permissive license is irrevocable for copies already taken. Removing it is the safe direction: it restores the conservative default (no grant) and needs no legal sign-off. Adding one back does, which is why the file is left intentionally empty pending review.

• pyproject.toml — license field removed, with a comment explaining why it must not come back un-decided
• LICENSE — intentionally empty, pending the organization's decision
• README.md — a Licensing section that states the same, rather than implying a grant

2. Vendored OSQP had no attribution.
The repo redistributes 48 files of vendored OSQP 1.0.0 (Apache-2.0) under src/shinro/runtime/codegen/emosqp/. Apache-2.0 §4(b)/(c) require shipping the license text and retaining notices. A license= string inside a vendored setup.py is not the license text — it is invisible to anyone consuming the repo.

• THIRD-PARTY.md — the inventory
• licenses/Apache-2.0.txt — the full text (§4(b))
• licenses/OSQP-NOTICE.txt — upstream copyright + provenance (§4(c))

The part that would have wasted the fix

MANIFEST.in listed only source globs, so the sdist silently dropped every file just added. Fixed with include LICENSE, include THIRD-PARTY.md, recursive-include licenses *.

Verified by building the artifact, not by reading the manifest:

$ python3 -m build --sdist --outdir /tmp/sdisttest
$ python3 -c "...inspect tar..."
  THIRD-PARTY  -> 1  ['THIRD-PARTY.md']
  LICENSE      -> 1  ['LICENSE']
  licenses/    -> 2  ['licenses/Apache-2.0.txt', 'licenses/OSQP-NOTICE.txt']
  vendored OSQP files in sdist: 51

pyproject.toml still parses (tomllib) and the sdist still builds.

Notes

• Rebased onto current main; contains only these 7 files, zero deletions.
• The outbound license remains undecided — this PR only removes a claim nobody made and meets an obligation that already existed. It deliberately does not choose one.
• Follow-up worth considering separately: a gate that fails the build when a vendored dir has no THIRD-PARTY.md entry, so this cannot regress.