fix: declare the package licence and ship MuJoCo's notice

[jcant0n]

Every push to nuget.org warns License missing, and the published package carries no licence expression — so nuget.org shows nothing where the licence link belongs and a compliance scanner has nothing to read.

EvergineTeam/WebGPU.NET#24 fixed this across the eight repositories that existed on 8 August. This one was created on the 10th and missed the sweep; Tracy.NET and Thorvg.NET are in the same position and get their own PRs.

Two changes

The expression. MIT describes the binding code, which is what PackageLicenseExpression is for, and matches this repository's LICENSE and the eleven other bindings.

The notice. MuJoCo is Apache-2.0 and its binaries ship under runtimes/, so the licence text now travels with them:

  <None Include="..\README.md" Pack="true" PackagePath="\" Visible="false" />
+ <!-- MuJoCo is Apache-2.0; redistributing its binaries requires shipping the notice. -->
+ <None Include="..\THIRD-PARTY-LICENSE-mujoco.txt" Pack="true" PackagePath="\" Visible="false" />

This is the pattern Tracy.NET and Thorvg.NET already use (Tracy-LICENSE.txt, THIRD-PARTY-LICENSE-thorvg.txt); this repository was one of the two shipping natives with no notice at all. Upstream has no NOTICE file, so Apache-2.0 §4(d) adds nothing further.

THIRD-PARTY-LICENSE-mujoco.txt is the verbatim text of google-deepmind/mujoco@LICENSE, preceded by two lines of attribution in the style of Tracy-LICENSE.txt. That header is needed because the Apache-2.0 boilerplate names no licensor — unlike the MIT and BSD texts the other two ship, a bare copy would not say what it covers. Deliberately without a version number: binding.yml already records the pinned release (3.11.0) and binding-fetch-upstream rewrites it on upgrades, so a number here would go stale in silence.

Verified, not assumed

Packed locally with the .NET 10 SDK and opened the .nupkg:

nuspec licence : <license type="expression">MIT</license>
package root   : ...nuspec, README.md, THIRD-PARTY-LICENSE-mujoco.txt, [Content_Types].xml, icon.png

Byte hygiene checked too — no BOM introduced, LF preserved, tabs preserved. That is the mistake WebGPU.NET#24 had to correct in its own second commit.

Not in scope

JoltPhysics.NET ships 72 MB of MIT natives with no notice either, and Cesium.NET, Vuforia.NET and RenderDoc.NET are unchecked. A fleet-wide notice audit is separate work.

🤖 Generated with Claude Code

[github-actions]

API gate: additive

Every symbol that existed still exists, unchanged. Nothing that compiled before stops compiling.

Target framework	Added	Removed
net10.0	+0	-0

_{Enum and constant values are part of the measured surface: a renumbering keeps compiling and sends the wrong number to the driver, so it counts as a removal.}