chore(license): 开发仓补齐双授权文件（AGPL-3.0 原样 + 商业轨）

导出仓已按「双轨」落地，开发仓此前无任何授权文件、package.json 也无 license 字段。

- LICENSE：AGPL-3.0 官方全文（34,523 B，逐字节未改，md5 4ae09d45…）
- COMMERCIAL-LICENSE.md / .zh-CN.md：轨 2 = 商业授权（与导出仓同一份内容）
- README.md：新增「## 许可证」节，说明两条轨的适用场景与源码披露义务

两条轨是**平行的许可选择**，商业轨不是对 AGPL 附加的限制；
⛔ 未改 package.json —— 其 license 字段由导出层规则插入，在源仓重复写入会与规则冲突。

COMMERCIAL-LICENSE.md

@@ -0,0 +1,32 @@
+> **English (primary, this file)** ｜ **[中文文档](COMMERCIAL-LICENSE.zh-CN.md)**
+
+[← Back to README](README.md)
+
+# Commercial license
+
+This project is **dual-licensed**: [GNU AGPL-3.0](LICENSE) is the default track, and the commercial track described here is an alternative to it. The two are **parallel choices** — buying the commercial track is not a requirement imposed on anyone using the AGPL track.
+
+## Which track applies
+
+| Your use | Track |
+|---|---|
+| Personal use, study, research, evaluation | 1 — AGPL-3.0 |
+| Internal deployment of an unmodified build | 1 — AGPL-3.0 |
+| Modified build, deployed or distributed with its source disclosed | 1 — AGPL-3.0 |
+| Closed-source hosted service offered to others | 2 — commercial |
+| Embedded in a proprietary product that you ship | 2 — commercial |
+
+Commercial use itself is allowed under **both** tracks. What distinguishes them is the source-disclosure obligation: AGPL-3.0 §13 requires that users of your modified build — including users of a network service — receive the corresponding source.
+
+## What the commercial track provides
+
+- The same rights AGPL-3.0 grants you, **without** the §13 source-disclosure obligation.
+- Scope, term, deployment model and fee are set in the agreement both sides sign. **This document is an invitation to negotiate; it is not itself a license grant.**
+
+## How to obtain one
+
+Write to **[email protected]** stating the intended use, the deployment model and the expected scale.
+
+## Third-party components
+
+Upstream DeepSeek Harness is licensed under the MIT License. This project does **not** include or distribute it — it is invoked at runtime as a separate process — so its terms are unaffected by either track above.