MIT text supplements for three npm packages

The exact pinned npm tarballs for @pm2/pm2-version-check 1.0.4, amp 0.3.1,
and amp-message 0.1.2 declare MIT in package.json and README. They do not
contain a complete license text or a copyright notice. Their installed files
were compared byte-for-byte with the official registry.npmjs.org tarballs
after verification against the package-lock.json SHA-512 integrity values.

MIT.txt is the unmodified canonical SPDX MIT text, supplied as a supplement
to those explicit publisher declarations, NOT presented as a file recovered
from the tarballs. Its <year> and <copyright holders> markers belong to the
canonical template; they are not invented package attribution. No absent
copyright holder or year has been inferred from an author or maintainer.
Original package metadata and README notices accompany each supplemented
entry in THIRD_PARTY_LICENSES.txt. Preserve all original package files/notices
when bundling the actual dependencies.

PROVENANCE.json records exact versions, official tarball URLs, archive hashes,
lock integrity, every published file hash, and the SPDX source/text hashes.
The evidence was fetched 2026-09-08 over HTTPS without GitHub. Historical npm
versions were also inspected; no full license files were recovered from them.

This closes missing license-body evidence for these declared-MIT packages;
it does not assert recovered upstream copyright notices or certify the legal
compliance of a complete installer. Bundled Node, FFmpeg/FFprobe and target-only
dependencies still require their actual notices, source/build provenance and
applicable redistribution obligations to be satisfied by the release owner.
