Non-SPDX license values are silently dropped from the published JSON-LD #46

Found while reviewing #4.

scripts/compile.ts maps an authored SPDX id to its canonical IRI, and drops anything it does not recognise with a warning only:

if (SPDX_IDS.has(resolver.license)) {
  entry.license = `https://spdx.org/licenses/${resolver.license}`;
} else {
  console.warn(`⚠ license "${resolver.license}" is not an SPDX id; omitted from output …`);
}

The build stays green, so a typo (CC-BY-4 for CC-BY-4.0) or a well-intentioned non-SPDX string silently removes the licence statement from the published record. Licence metadata dropping out unnoticed is the wrong failure mode for a registry whose whole value is machine-readable claims — and registry#9 already had to clean one round of these by hand.

Suggestion: make it a hard failure. scripts/validate-data.ts is the natural place (it already walks every compiled record and exits non-zero), or fail directly in buildResolverEntry. The spec text in specification.md §9 already tells authors what to do instead:

For licences not in the SPDX list, omit license and use the optional license_url to point at the licence text.

so the error message can just quote that.