docs(licenses): record initial dependency license review

[josecelano]

Records the first evidence-grounded technical dependency-license review for #269.

The review retains compact inventories for the complete locked graph (575 packages) and a runtime-oriented view (510 packages), with reproducible commands, checksums, and published-source records for non-routine declarations. It also adds the missing workspace license inheritance for workspace-coupling.

No legal compatibility conclusion or license-enforcement policy is introduced. The direct runtime bloom GPL-2.0 dependency, all five LGPL-3.0 declarations, and other non-routine expressions remain pending maintainer classification and qualified legal review where required.

Pending Maintainer Actions

1. Start with bloom: record how it is used and distributed, then obtain qualified legal guidance before approving continued use, an exception, or replacement.
2. For each remaining pending finding, record the package/version/license evidence, dependency kind and reachability, and which distributed artifacts include or depend on it.
3. Read the linked license and notice files, recording plainly stated notice or text-retention requirements without inferring legal compatibility from SPDX metadata.
4. Record one disposition per finding: escalate for qualified legal review, create remediation work, or propose an approval rationale after the required review is complete.
5. Obtain an explicit approval or objection from every active maintainer. A missing response remains pending; approval records the project decision and is not an individual legal opinion.
6. Create focused remediation issues for every finding that cannot be approved. Do not add automated license enforcement until an approved SPDX policy and exception process exist.

Related to #269.

[Copilot]

Pull request overview

This PR records the initial, evidence-grounded technical dependency-license review for issue #269 by adding reproducible inventories (locked graph + runtime-oriented view) and accompanying review/evidence documentation, plus closing a missing workspace license inheritance gap for the workspace-coupling crate.

Changes:

• Add initial review report (initial-review.md) and evidence ledger (evidence.md) for dependency license declarations, including reproducible commands and checksums.
• Add deterministic JSON inventories for the locked dependency graph and a runtime-oriented subset, and exclude those large JSON files from spellchecking noise.
• Ensure workspace-coupling explicitly inherits the workspace AGPL-3.0-only license via license.workspace = true.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
project-words.txt	Adds SPDX/metadata-related terms used in the new license review docs.
docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json	Adds the runtime-oriented dependency license inventory artifact.
docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json	Adds the complete locked-graph dependency license inventory artifact.
docs/issues/open/269-review-dependency-licenses/ISSUE.md	Updates the issue spec to reference and track the initial review artifacts and current status.
docs/issues/open/269-review-dependency-licenses/initial-review.md	Adds the initial technical review report (explicitly non-legal).
docs/issues/open/269-review-dependency-licenses/evidence.md	Adds the reproducible evidence ledger backing the report’s findings.
cspell.json	Excludes the large JSON inventory files from cspell scanning.
contrib/dev-tools/analysis/workspace-coupling/Cargo.toml	Makes workspace-coupling inherit the workspace license (license.workspace = true).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.87%. Comparing base (6afa21e) to head (68346b8).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2113      +/-   ##
===========================================
- Coverage    83.88%   83.87%   -0.01%     
===========================================
  Files          349      349              
  Lines        26998    26998              
  Branches     26998    26998              
===========================================
- Hits         22647    22645       -2     
  Misses        4008     4008              
- Partials       343      345       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.