Software license compliance scanning: from SPDX identifiers to gate policy

Land license compliance scanning with SPDX identifiers, allow/review/deny policy, and approved TTL exceptions. Draft machine-readable policy so most license decisions move into the pipeline—fewer hand reviews line by line.