SPDX normalization + policy-as-code + green/yellow/red decisions: let most PRs auto-decide so legal only sees the yellow and red cases that need a human.