Point the notice at the licence it promises

[iderex]

The issue this belongs to

Closes #12

What changed

NOTICE.md tells a reader that the license contains the full warranty and
liability disclaimer. It named no file, and until recently there was no file to
name. There is one now, so the sentence links to it.

What failure it prevents

A reader who wants to know what warranty they are getting reads NOTICE.md, is
told the answer is in the license, and is then left to find it. The disclaimer
is the thing they were sent to look for, and the distance between the promise
and the document was one link.

Evidence

The licence is at the root and GitHub reads it:

git ls-tree --name-only origin/main LICENSE
LICENSE

gh api repos/Flowfin/core --jq '{spdx: .license.spdx_id, name: .license.name}'
{"name":"GNU Affero General Public License v3.0","spdx":"AGPL-3.0"}

The sections NOTICE.md sends a reader to are in it:

git show origin/main:LICENSE | grep -n -E '^ *1[5-7]\.'
587:  15. Disclaimer of Warranty.
598:  16. Limitation of Liability.
610:  17. Interpretation of Sections 15 and 16.

README.md names the licence under its second heading, which a reader reaches
without scrolling:

git show origin/main:README.md | grep -n -A2 '^## License'
11:## License
12-
13-AGPL-3.0, copyright 2026 Nils Lehnen.

The new link is a path this tree's own checker reads, and it resolves. The count
moves by exactly one, which is what says the link joined the population rather
than sitting beside it. With origin/main's NOTICE.md in the working tree:

bash .github/doc-paths/doc-paths.sh check | grep -A1 names-a-path-that-resolves
-- names-a-path-that-resolves
ok    56 document(s), 61 named path(s) resolved, 0 excused as examples

and with this branch's:

bash .github/doc-paths/doc-paths.sh check | grep -A1 names-a-path-that-resolves
-- names-a-path-that-resolves
ok    56 document(s), 62 named path(s) resolved, 0 excused as examples

The unicode guard's scan, run the way the workflow runs it:

pattern='(*UTF)[\x{202A}-\x{202E}\x{2066}-\x{2069}\x{200E}\x{200F}\x{061C}\x{200B}-\x{200D}\x{2060}]'
rc=0; git grep -nIP "$pattern" -- . || rc=$?; echo "rc=$rc"
rc=1

which is the clean exit rather than a match found.

The sign-off comparison the DCO workflow makes, run against the commit being
pushed:

sha=$(git rev-parse HEAD)
an=$(git show -s --format='%an' "$sha"); ae=$(git show -s --format='%ae' "$sha")
git show -s --format='%B' "$sha" | grep -qxF "Signed-off-by: ${an} <${ae}>" && echo "ok $sha"
ok 68ca74d770095a97e57199acc354b59331056104

What a guard here refuses, and the proof it bites

This change adds no guard. The counts above are an existing check reading one
more path, not a new refusal.

What this does not cover

Entry 1 of #1 carries no written answer, and the five options it lists do not
include AGPL-3.0. What the tree carries is the licence #157 argued for and
landed. The condition #1 sets for itself, that each entry has an answer written
into it, is untouched here.

Nothing reads whether the sentence in NOTICE.md is true of the file it now
names. The path check reads that the target resolves and stops there. Whether
sections 15 to 17 are what a reader was promised is read by a person.

Two of the four conditions on #12, the licence field and the sentence in
README.md, were already met before this change rather than by it. I checked
them and did not produce them.

Who has read it

Nobody other than me has read this change. The commands above stand in place of
a review rather than beside one.