Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.

docs/phase-4-runbook.md

@@ -355,8 +355,9 @@ docker run --rm --network sentry_default -v $(pwd)/api:/src -w /src \
 earlier in Phase 4, once `enterprise/cmd/enterprise-api` needed to
 import it: Go's compiler-enforced `internal/` visibility rule meant a
 separate module like `enterprise/` could never import anything under
-`api/internal/...`, regardless of the AGPL/commercial licensing
-boundary, which only forbids the reverse direction.)
+`api/internal/...`, regardless of the licensing boundary (AGPL/commercial
+at the time this was written; both AGPLv3 as of Phase 6), which only
+forbids the reverse direction.)
 
 Expect all `TestIntegration*` tests to pass, including
 `TestIntegrationDashboardTenantForeignKeyRejectsUnknownTenant` (the
@@ -921,8 +922,10 @@ same registry the read side (§9) already uses -- routing each record's
 write into its own tenant's Tantivy index instead of the single default
 one. No "second binary" was needed here the way ClickHouse needed
 `enterprise-ingest`: Tantivy has no grant system to gate a
-commercially-licensed credential behind, so `IndexRegistry` already
-lives directly in AGPL-core `search`, and read/write just share it.
+separately-credentialed binary behind (commercially licensed at the
+time this was written; AGPLv3 as of Phase 6, though the architectural
+point never depended on that), so `IndexRegistry` already lives directly
+in AGPL-core `search`, and read/write just share it.
 Because Tantivy is an embedded library (no Docker/broker needed to
 exercise real logic), this actually ran in this environment: