Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.

ingest/README.md

@@ -42,7 +42,8 @@ This package (AGPL core) only ever writes to one shared ClickHouse
 database, regardless of any `tenant_id` tag a message carries -- routing
 a tagged record into its own tenant's dedicated database is
 `enterprise/internal/chwriter` and `enterprise/cmd/enterprise-ingest`'s
-job (commercial-licensed, per `/CLAUDE.md`'s licensing boundary), not
+job (a separate module by architectural convention, not a licensing
+split -- both are AGPLv3, see `/CLAUDE.md`'s licensing boundary), not
 this package's. `consumer` and `clickhousewriter` live outside
 `internal/` (moved there once `enterprise/internal/chwriter` needed to
 import them directly -- Go's compiler-enforced `internal/` visibility

ingest/clickhousewriter/writer.go

@@ -5,8 +5,9 @@
 // tenant -- same reasoning api/internal/dashboards and friends moved out
 // of internal/ earlier in Phase 4: Go's compiler-enforced internal/
 // visibility blocks a separate module (enterprise/) from importing
-// anything under ingest/internal/..., regardless of what the AGPL/
-// commercial licensing boundary itself would otherwise allow.
+// anything under ingest/internal/..., independent of licensing --
+// both modules are AGPLv3 as of Phase 6, and this was always an
+// import-graph constraint, not a license one.
 package clickhousewriter
 
 import (

ingest/internal/tenantresolver/tenantresolver.go

@@ -1,9 +1,9 @@
 // Package tenantresolver is ingest's HTTP client for resolving an
 // agent-presented ingest credential to a tenant -- calls enterprise-
 // auth's POST /internal/authorize-ingest over the network, never
-// importing enterprise/ (ingest is AGPL core; enterprise/ is
-// commercial-licensed and must never be imported by core code -- same
-// "network boundary, not import boundary" shape api/authz.HTTPAuthorizer
+// importing enterprise/ (both ingest and enterprise/ are AGPLv3 as of
+// Phase 6; the import boundary is architectural, not a licensing wall --
+// same "network boundary, not import boundary" shape api/authz.HTTPAuthorizer
 // already uses for the query path, and enterprise-auth's own doc
 // comment on POST /internal/authorize-ingest). nil (no resolver
 // configured) is grpcserver.Server's documented no-op default --