world-adm0's 162 licences are established, and 65 are share-alike

upg100-plugin ran the per-country fetch (304a4c120): 162 queries against the
geoBoundaries endpoint, values recorded verbatim, 0 failures, one spot-check
re-verified live. 130 of 162 countries carry a duty; only 32 are duty-free.

ATTRIBUTION now says the world-adm0 duties are DISCHARGEABLE and points at the
single authority for them -- their PROVENANCE.json -- rather than copying the
table, because one table in two places drifts. Their words.

★ THE DUTIES ARE RECORDED AS CLASSES, NOT AS ONE THING. They separated the 7
explicit ShareAlike countries because share-alike is a stronger duty than
attribution, which is right; by the same reasoning the class holds 65, because
Open Data Commons ODbL 1.0 also requires a derivative database to be offered
under ODbL. 58 ODbL + 7 CC-SA. This repository already acted on that reading:
Natural Earth's 1:10m roads were deliberately not shipped over an ODbL
obligation. Whether "licensed alike" binds a giveaway is a legal question, not
a measurement, and it is recorded as open rather than resolved here.

The CCK line is gone. It read as an outstanding gap; CCK is absent from
world-adm0 entirely, so that 404 was a fetch for a country that never shipped.

data/boundaries/ATTRIBUTION

@@ -29,13 +29,33 @@ gb-CHN-ADM1.geojson
 world-adm0.geojson, world-adm0-web.geojson
   source          geoBoundaries gbOpen (www.geoboundaries.org), assembled per country
   features        162 countries
-  licence         MIXED, AND NOT YET RECORDED PER COUNTRY.
-  gbOpen passes each country's UPSTREAM licence through, so this one file carries up to 162
-  different licences and therefore up to 162 separate attribution duties. The collection's own
-  provenance record (the plugin's data/adm0/PROVENANCE.json) states that principle but its
-  licences table is EMPTY, so which of the 162 are Creative Commons and which are public domain
-  is not established here. Establishing it means querying the endpoint above once per country.
-  UNTIL THEN, TREAT THIS FILE AS CARRYING ATTRIBUTION DUTIES THAT ARE NOT YET DISCHARGED.
-  One known gap in that record: CCK (Cocos Islands) returned HTTP 404 for its metadata.
+  licence         MIXED — and now ESTABLISHED per country, not merely acknowledged.
+  THE PER-COUNTRY TABLE IS THE AUTHORITY, and it lives in ONE place on purpose:
+      plugin-designs/my-upg-100-list/data/adm0/PROVENANCE.json
+  It records boundaryLicense, licenseSource and boundaryID for all 162, each value taken
+  verbatim from https://www.geoboundaries.org/api/current/gbOpen/<ISO3>/<LEVEL>/ (162 queries,
+  0 failures, one spot-check re-verified against the live API). This file deliberately does NOT
+  copy that table: one table in two places drifts.
+
+  130 OF THE 162 CARRY A DUTY. Only 32 are duty-free (28 Public Domain, 4 CC0). By class:
+
+    ATTRIBUTION-ONLY (credit the source)
+      44  CC BY 4.0        13  CC BY 3.0 IGO        4  CC BY 2.5        2  CC BY 3.0
+      2  Open Government Licence v3
+
+    SHARE-ALIKE CLASS — A STRONGER DUTY: a derivative may have to be licensed alike, which is
+    the class that actually constrains giving this repository away.
+      58  Open Data Commons ODbL 1.0
+       7  Creative Commons ShareAlike 2.0 / 3.0 — AGO GAB GEO GIN MMR NER TUR
+
+    ODbL IS LISTED IN THAT CLASS DELIBERATELY. Alongside attribution it requires a Derivative
+    Database to be offered under ODbL and carries a keep-open provision, so by volume the
+    share-alike question covers 65 of 162 countries, not 7. This repository has already acted on
+    that reading once: library/scripts/posters/data/README.md records that Natural Earth's 1:10m
+    ROADS were requested and deliberately NOT shipped because of an ODbL obligation.
+    WHETHER 'licensed alike' binds a giveaway of this repository is a legal question, not a
+    measurement, and it is open. It is recorded here so nobody has to rediscover it.
+
+    duty-free: 28 Public Domain, 4 CC0.
 
 See documentation/THIRD-PARTY.md for the whole shipped tree.