fix: satisfy the nightly license audit

[kixelated]

The nightly (34473996355, also 34348703531) fails just rs audit with two license errors. Both arrived when the moq-net fuzz harness joined the workspace in #3543; the audit is nightly-only by design, so no PR gate caught it.

• libfuzzer-sys 0.4.13 is (MIT OR Apache-2.0) AND NCSA. The NCSA term covers the vendored LLVM libFuzzer harness and is OSI approved / FSF Free, so allow it in deny.toml.
• moq-net-fuzz has no license field, so cargo-deny treats it as unlicensed. Declare MIT OR Apache-2.0, matching every other workspace crate.

advisories ok: 0 errors, 0 warnings, 8 notes
      bans ok: 0 errors, 77 warnings, 0 notes
   licenses ok: 0 errors, 0 warnings, 995 notes
    sources ok: 0 errors, 0 warnings, 0 notes

Verified with nix develop --command just rs audit locally. No API or wire impact.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T17:31:20.288339Z	79cccea	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f338a6aa-191c-4e49-ac9b-922106e1e26e

📥 Commits

Reviewing files that changed from the base of the PR and between 0f7cbd7 and 79cccea.

📒 Files selected for processing (2)

• deny.toml
• rs/moq-net/fuzz/Cargo.toml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The fuzz crate manifest now declares MIT OR Apache-2.0. The repository license allowlist now includes NCSA, with a comment identifying vendored LLVM libFuzzer code as the source.

Merge Risk: ⚪ Minimal · up to 79ccc

This change records the fuzz crate’s license and permits the NCSA license used by its vendored fuzzing dependency, without changing runtime or wire behavior. It is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains both license audit fixes and matches the changeset.
Title check	✅ Passed	The title concisely identifies the license audit fix, which is the main purpose of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/nightly-audit-licenses

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}