chore: enforce dependency license policy in CI

[DominikPinsel]

chore: enforce dependency license policy in CI

Context

AInsel is licensed under Apache-2.0. A license audit of the dependency tree (go-licenses across all 8 Go modules, pnpm licenses for the frontend) confirmed everything is currently permissive (MIT/Apache-2.0/BSD/ISC). This issue adds automated guardrails so a copyleft or otherwise problematic dependency can never slip in unnoticed via a future bump.

Goal

CI fails when a dependency with a disallowed license is introduced. No runtime behavior changes.

Scope

Go (all workspace modules):

go-licenses check --disallowed_types forbidden --disallowed_types restricted --disallowed_types reciprocal ./...

Run in each of: operators/agent, operators/event-gateway, services/{chat-mcp,hub,mcp,webhook-receiver}, shared/api, shared/auth/oidc.

Frontend (prod deps only):
Assert every license reported by pnpm licenses list --json --prod is in the allowlist:
MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, Unlicense, CC0-1.0, BlueOak-1.0.0

Dual-licensed packages (e.g. (MPL-2.0 OR Apache-2.0)) pass if any option is in the allowlist; the election is documented in NOTICE.

Acceptance criteria

• CI job runs on PRs touching go.mod/go.sum/pnpm-lock.yaml
• Job fails with a readable message naming the offending package + license on violation
• Known-first-party "unknown license" noise is suppressed (per-module LICENSE handling, see below)
• Passes on current main

Implementation notes

• Install github.com/google/go-licenses in the CI image (or use the golang image and go install).
• First-party noise: go-licenses flags our own packages because LICENSE only exists at the monorepo root. Fix by symlinking LICENSE into each module dir.
• Exceptions process: new allowlist entries or go-licenses skips require explicit review — document this in the workflow file as a comment.

Out of scope

• Generating a THIRD_PARTY_NOTICES bundle at release time (separate issue)
• Dev-dependency checking (optional follow-up; dev deps are not distributed)