SPDX attribution is not license transfer

Trap: adding an SPDX license identifier or copyright notice looks like an institutional licensing edge because it names a license or legal owner. Fix: treat it as attribution or repository control unless the source explicitly changes license terms, licensing authority, ownership, or another institutional right; normalizing a file header alone does not change the power graph.