S15.2: XFeat exports at a fixed shape and loads under tract

tools/export-xfeat.sh exports the convolutional network alone at 768×1024
grayscale, on the pattern of export-seg-model.sh: thirteen standard
operator types, no dynamic axes, the keypoint decoding left to Rust.
examples/onnx_probe loads it through the ort-over-tract backend the app
ships with nothing unsupported and runs it in ~300 ms on the desktop CPU.

The weights are Apache-2.0, read from the repository's LICENSE, with no
grant on the checkpoint — recorded in models/LICENCE.md before they land,
as FR-MRG-8 asks. The probe stays: the next model will need the same
check.

models/LICENCE.md

@@ -11,6 +11,8 @@ same script:
 
 Both come from `https://huggingface.co/Ultralytics/YOLO26`. The face weights in
 `face/` are a separate matter with a separate grant — see `face/README.md`.
+The keypoint weights in `keypoints/` are a third, and the easiest — see the
+last section.
 
 ## The grant
 
@@ -69,3 +71,28 @@ Neither replaces the other. Keeping both is the deliberate choice.
 The loader treats each vocabulary as model metadata rather than compiled-in
 knowledge, which is what made adding the second model a file plus a descriptor
 rather than a code change — as this document predicted it would be.
+
+## `keypoints/` — XFeat, Apache-2.0
+
+| File | Source | Trained on | Used by |
+|---|---|---|---|
+| `keypoints/xfeat-1024.onnx` | `weights/xfeat.pt` from `https://github.com/verlab/accelerated_features` | MegaDepth + synthetic warps, by the authors | panorama alignment (FR-MRG-8) |
+
+Exported by `tools/export-xfeat.sh` at a fixed 768×1024 grayscale input.
+Only the convolutional network is in the file; the keypoint decoding is Rust.
+
+**The repository and its weights are Apache-2.0**, read on 2026-09-19 from the
+`LICENSE` at its root, with no separate grant on the checkpoint and no
+non-commercial clause anywhere in the tree. Apache-2.0 is GPLv3-compatible
+one way — code and weights under it may be combined into a GPLv3 work — so
+this is neither the InsightFace situation (D13, a use restriction that binds
+every user) nor the Ultralytics one (D14, where the combined work becomes
+AGPL). It is the licence position this document would have wanted for every
+model in it, and it was chosen over stronger detectors partly for that reason:
+SuperPoint and SuperGlue are non-commercial, R2D2 and SiLK are CC BY-NC.
+
+The training data is the authors' concern, not a licence on the weights:
+XFeat trains on MegaDepth, which is itself a research dataset, but the weights
+are released under the repository's licence without a data-derived
+restriction — unlike the gaze models §7 of the requirements declined, where
+the dataset licence restricts models trained on it by name.