Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.

ingest/clickhousewriter/writer.go

@@ -5,8 +5,9 @@
 // tenant -- same reasoning api/internal/dashboards and friends moved out
 // of internal/ earlier in Phase 4: Go's compiler-enforced internal/
 // visibility blocks a separate module (enterprise/) from importing
-// anything under ingest/internal/..., regardless of what the AGPL/
-// commercial licensing boundary itself would otherwise allow.
+// anything under ingest/internal/..., independent of licensing --
+// both modules are AGPLv3 as of Phase 6, and this was always an
+// import-graph constraint, not a license one.
 package clickhousewriter
 
 import (