#000061: CLI flag --allow-license-class for Gap 2 override

The license_class gate landed in 576cb0e but only push_pack() the
function takes allow_license_class — the CLI couldn't pass it through.
Adds --allow-license-class {public_redistributable,unknown,private}
to `arborist cold pack`. Default stays at public_redistributable;
operators override only after confirming bucket ACL + source license
permit redistribution.

33/33 tests pass.

arborist/cli.py

@@ -2834,6 +2834,7 @@ def _cmd_cold_pack(args: argparse.Namespace) -> int:
             max_pack_bytes=args.max_pack_bytes,
             local_dir=args.local_dir,
             push_to_bucket=args.push_to_bucket,
+            allow_license_class=args.allow_license_class,
         )
     finally:
         conn.close()
@@ -5734,6 +5735,16 @@ def build_parser() -> argparse.ArgumentParser:
         "--no-push", dest="push_to_bucket", action="store_false",
         help="skip the bucket upload — only write locally via --local-dir",
     )
+    cold_pack.add_argument(
+        "--allow-license-class",
+        dest="allow_license_class",
+        default="public_redistributable",
+        choices=["public_redistributable", "unknown", "private"],
+        help="strictest license_class arborist will push to the bucket. "
+        "Default refuses unknown/private shards on a public bucket "
+        "(Gap 2 per #000061 review). Override only after confirming the "
+        "bucket ACL + source licensing permit redistribution.",
+    )
     cold_pack.set_defaults(func=_cmd_cold_pack, push_to_bucket=True)
 
     cold_unpack = cold_sub.add_parser(