Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.

ingest/README.md

@@ -42,7 +42,8 @@ This package (AGPL core) only ever writes to one shared ClickHouse
 database, regardless of any `tenant_id` tag a message carries -- routing
 a tagged record into its own tenant's dedicated database is
 `enterprise/internal/chwriter` and `enterprise/cmd/enterprise-ingest`'s
-job (commercial-licensed, per `/CLAUDE.md`'s licensing boundary), not
+job (a separate module by architectural convention, not a licensing
+split -- both are AGPLv3, see `/CLAUDE.md`'s licensing boundary), not
 this package's. `consumer` and `clickhousewriter` live outside
 `internal/` (moved there once `enterprise/internal/chwriter` needed to
 import them directly -- Go's compiler-enforced `internal/` visibility