fix: declare the binding's licence, not Embree's

[jcant0n]

The package declared Apache-2.0. That is Embree's licence, not this binding's — the expression describes the code in the package, and the binding code is MIT, which is what this repository's LICENSE has always said and what the other eleven bindings declare while shipping third-party natives.

- <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
+ <PackageLicenseExpression>MIT</PackageLicenseExpression>

Why the notice comes with it

Changing that line on its own would have made one thing worse. Apache-2.0 was the only mention of the native library's licence anywhere in the nupkg, and Embree's binaries do ship, under runtimes/. Flipping it to MIT would have left the package silent about what it redistributes.

  <None Include="..\README.md" Pack="true" PackagePath="\" Visible="false" />
+ <!-- Embree is Apache-2.0; redistributing its binaries requires shipping the notice. -->
+ <None Include="..\THIRD-PARTY-LICENSE-embree.txt" Pack="true" PackagePath="\" Visible="false" />

This is the pattern Tracy.NET and Thorvg.NET already use (Tracy-LICENSE.txt, THIRD-PARTY-LICENSE-thorvg.txt); this repository was one of the two shipping natives with no notice at all. Upstream has no NOTICE file, so Apache-2.0 §4(d) adds nothing further.

THIRD-PARTY-LICENSE-embree.txt is the verbatim text of RenderKit/embree@LICENSE.txt, preceded by two lines of attribution in the style of Tracy-LICENSE.txt. That header is needed because the Apache-2.0 boilerplate names no licensor — the file is byte-identical to MuJoCo's upstream LICENSE (same sha256), so a bare copy genuinely would not say which component it covers. Deliberately without a version number: binding.yml already records the pinned release (v4.4.1) and binding-fetch-upstream rewrites it on upgrades, so a number here would go stale in silence.

Verified, not assumed

Packed locally with the .NET 10 SDK and opened the .nupkg:

nuspec licence : <license type="expression">MIT</license>
package root   : ...nuspec, README.md, THIRD-PARTY-LICENSE-embree.txt, [Content_Types].xml, icon.png

Byte hygiene checked too — no BOM introduced, LF preserved, tabs preserved. That is the mistake WebGPU.NET#24 had to correct in its own second commit.

Not in scope

JoltPhysics.NET ships 72 MB of MIT natives with no notice either, and Cesium.NET, Vuforia.NET and RenderDoc.NET are unchecked. A fleet-wide notice audit is separate work.

🤖 Generated with Claude Code

[github-actions]

API gate: additive

Every symbol that existed still exists, unchanged. Nothing that compiled before stops compiling.

Target framework	Added	Removed
net10.0	+0	-0

_{Enum and constant values are part of the measured surface: a renumbering keeps compiling and sends the wrong number to the driver, so it counts as a removal.}