ci: add dependency license compatibility check

[nabinchha]

Priority Level

Medium

Task Summary

Add a CI job that validates the licenses of DataDesigner's locked runtime dependency closure against an explicit Apache-2.0 compatibility policy.

The check should prevent new dependencies with unknown or unapproved licenses from being introduced without review.

Technical Details & Implementation Plan

• Install the locked production dependency set with uv sync --all-packages --no-dev --locked.
• Scan installed package metadata and bundled license files with a pinned license-scanning tool.
• Maintain a repository-owned global license allowlist containing:
  • Apache-2.0
  • BSD-3-Clause
  • BSD-2-Clause
  • ISC
  • MIT
  • Zlib
• Maintain exact-license, package-specific exceptions for reviewed dependencies outside the global allowlist:
  • certifi
  • chardet
  • email-validator
  • numpy
  • pathspec
  • pillow
  • regex
  • tqdm
  • typing_extensions
• Require every exception to include the expected reported license and a review rationale.
• Fail CI when:
  • A package has an unknown or unrecognized license.
  • A new package uses a license outside the global allowlist.
  • An excepted package changes its reported license.
  • An exception becomes stale because its package is no longer installed.
• Add a Make target for running the check locally.
• Add tests covering allowed licenses, rejected licenses, bundled license-text detection, license drift, and stale exceptions.

Acceptance Criteria

• CI checks the complete locked runtime dependency closure.
• The current dependency set passes using explicitly documented exceptions.
• New unapproved licenses fail with the package name, version, and reported license.
• Package exceptions do not globally authorize their licenses for other dependencies.
• The check is reproducible locally using a Make target.
• Formatting, linting, and license-policy tests pass.

Investigation / Context

The repository already checks SPDX source-file headers, but it does not enforce dependency-license compatibility.

PR #543 added dependency-health auditing but does not inspect dependency licenses. PRs #279, #253, and #164 concern source-file license headers and are not duplicates.

Agent Plan / Findings

A prototype validated 90 installed runtime packages. The global allowlist and package-specific exceptions were kept separate so approval remains narrowly scoped. The prototype detects metadata license changes, stale exceptions, unknown licenses, and license text supplied only through packaged license files.

Dependencies

None.