Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.

ingest/internal/tenantresolver/tenantresolver.go

@@ -1,9 +1,9 @@
 // Package tenantresolver is ingest's HTTP client for resolving an
 // agent-presented ingest credential to a tenant -- calls enterprise-
 // auth's POST /internal/authorize-ingest over the network, never
-// importing enterprise/ (ingest is AGPL core; enterprise/ is
-// commercial-licensed and must never be imported by core code -- same
-// "network boundary, not import boundary" shape api/authz.HTTPAuthorizer
+// importing enterprise/ (both ingest and enterprise/ are AGPLv3 as of
+// Phase 6; the import boundary is architectural, not a licensing wall --
+// same "network boundary, not import boundary" shape api/authz.HTTPAuthorizer
 // already uses for the query path, and enterprise-auth's own doc
 // comment on POST /internal/authorize-ingest). nil (no resolver
 // configured) is grpcserver.Server's documented no-op default --