licence(A5/#7): normalise malformed PMPL SPDX values (owner carve-out, SPDX-only) (#82)

3 files. PLMP/PMLP placeholder + doubled-suffix + bare PMPL-1.0 ->
canonical PMPL-1.0-or-later. SPDX-value-only, NOT a relicence.
Owner-sanctioned, standards LICENCE-POLICY A8(1)+A5. Refs
LICENCE-DEBT-LEDGER-2026-05-18. 🤖 Generated with [Claude
Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: CodeQL Security Analysis
 
 on:

.github/workflows/scorecard.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: OSSF Scorecard
 on:
   push:

.github/workflows/secret-scanner.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Prevention workflow - scans for hardcoded secrets before they reach main
 name: Secret Scanner