From Permission to Contract: Dual Enforcement and Rising Risk in Open Source