docs(licenses): record initial dependency license review

[josecelano]

Records the first evidence-grounded technical dependency-license review for #269.

The review retains compact inventories for the complete locked graph at its initial review snapshot (575 packages) and a runtime-oriented view (510 packages), with reproducible commands, checksums, and published-source records for non-routine declarations. It also adds the missing workspace license inheritance for workspace-coupling.

The direct runtime bloom GPL-2.0 finding is technically resolved: Issue #2114 and merged PR #2119 removed bloom and its transitive bit-vec dependency after a focused Criterion comparison found the exact-map path faster for the measured operations. The report retains the original bloom evidence for any review of releases that included it; it makes no conclusion about those releases.

No license-enforcement policy is introduced. The five LGPL-3.0 declarations and other non-routine expressions remain pending maintainer classification and qualified legal review where required.

Pending Maintainer Actions

1. For each remaining pending finding, record the package/version/license evidence, dependency kind and reachability, and which distributed artifacts include or depend on it.
2. Read the linked license and notice files, recording plainly stated notice or text-retention requirements without inferring legal compatibility from SPDX metadata.
3. Record one disposition per finding: escalate for qualified legal review, create remediation work, or propose an approval rationale after the required review is complete.
4. Obtain an explicit approval or objection from every active maintainer. A missing response remains pending; approval records the project decision and is not an individual legal opinion.
5. Create focused remediation issues for every finding that cannot be approved. Do not add automated license enforcement until an approved SPDX policy and exception process exist.

Related to #269.

[Copilot]

Pull request overview

This PR records the initial, evidence-grounded technical dependency-license review for issue #269 by adding reproducible inventories (locked graph + runtime-oriented view) and accompanying review/evidence documentation, plus closing a missing workspace license inheritance gap for the workspace-coupling crate.

Changes:

• Add initial review report (initial-review.md) and evidence ledger (evidence.md) for dependency license declarations, including reproducible commands and checksums.
• Add deterministic JSON inventories for the locked dependency graph and a runtime-oriented subset, and exclude those large JSON files from spellchecking noise.
• Ensure workspace-coupling explicitly inherits the workspace AGPL-3.0-only license via license.workspace = true.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
project-words.txt	Adds SPDX/metadata-related terms used in the new license review docs.
docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json	Adds the runtime-oriented dependency license inventory artifact.
docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json	Adds the complete locked-graph dependency license inventory artifact.
docs/issues/open/269-review-dependency-licenses/ISSUE.md	Updates the issue spec to reference and track the initial review artifacts and current status.
docs/issues/open/269-review-dependency-licenses/initial-review.md	Adds the initial technical review report (explicitly non-legal).
docs/issues/open/269-review-dependency-licenses/evidence.md	Adds the reproducible evidence ledger backing the report’s findings.
cspell.json	Excludes the large JSON inventory files from cspell scanning.
contrib/dev-tools/analysis/workspace-coupling/Cargo.toml	Makes workspace-coupling inherit the workspace license (license.workspace = true).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.99%. Comparing base (576f366) to head (493d35d).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2113      +/-   ##
===========================================
- Coverage    83.99%   83.99%   -0.01%     
===========================================
  Files          349      349              
  Lines        26996    26996              
  Branches     26996    26996              
===========================================
- Hits         22676    22675       -1     
  Misses        3981     3981              
- Partials       339      340       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[josecelano]

Maintainer decision: defer the remaining dependency-license dispositions until the package-overhaul EPIC has defined the final package boundaries, publication status, and distributable artifacts.

The completed bloom remediation remains recorded separately. Retain the inventories and source evidence in this PR as the baseline, but do not infer approval, legal compatibility, or an enforcement policy for the remaining findings yet.

Resume the review when the extraction and distribution decisions are complete, or earlier if a package becomes externally published. At that point, regenerate the locked and runtime inventories, compare them with this snapshot, and classify the final distributed artifacts.