Package hygiene: per-package LICENSE, transformabl facade range, dead deps, tsbuildinfo, engines #42

Package hygiene batch (pre-star-push)

Class-level packaging defects found in the 2026-07-23 sweep. Fix across all published packages.

• LICENSE listed in files but shipped in ZERO tarballs. Every package.json lists "LICENSE" in files, but the file only exists at repo root — npm only auto-includes LICENSE from the package dir. So every published tarball claims MIT and ships no license file. Fix: add a per-package LICENSE (copy or a prepublish copy step). This silently no-ops on every future publish otherwise.
• transformabl facade range ^0.3.0 can never resolve the 0.4.x ReDoS fix. Bump to ^0.4.1 when transformabl-core 0.4.1 ships (tracked in the 0.4.1 release issue).
• Four declared-but-unused deps read as badge-padding. identifiabl-core (declared, never imported by prod), and the transformabl/validatabl/limitabl middleware facades are declared in gatewaystack-connect but never imported — an evaluator running npm ls vs imports finds them. Decide: use them or drop them.
• identifiabl declares unused jose@^5 — dist never imports jose; causes a dual-jose install (5.x hoisted + 6.x under core). Drop it.
• tsconfig.tsbuildinfo shipped in dist of 10/12 packages. Dead dev file in the tarball (same class as proxyabl's tool-gateway.js). Exclude it or set tsBuildInfoFile outside dist.
• No engines field in any package despite ESM-only + (post-fix) global-fetch reliance. Add "node": ">=18".
• request-context has no prepublishOnly build — stale-dist publish risk. Add it.
• proxyabl pins request-context exactly (0.0.6) while identifiabl uses ^ — future patches force a proxyabl republish. Loosen to ^.

Note

The two fresh-install-break fixes (jose in proxyabl-core, node-fetch in explicabl) and the identifiabl README export fix are already in PRs #35, #37, #38. The LICENSE-at-root was added in #34. This issue covers the remaining class-level items.