refactor(arch): architectural reconciliation — compose profiles, TOML parsers, SPDX, pipeline fix

- Split selur-compose.yml into two profiles: default (6 trust-pipeline services)
  and container-security (4 opt-in services: svalinn/selur/vordr/cerro-torre)
- Delete duplicate native/pq_crypto NIF crate; canonical NIF is opsm_pq_nif
- Replace naive line-splitting TOML parsers in 9 registry adapters (betlang,
  ephapax, tangle, wokelang, julia_the_viper, eclexia, my_lang, error_lang,
  oblibeny) with Opsm.Manifest.OpsmToml.parse/1
- Replace line-splitting parse_workspace_members/1 in cli.ex with Toml.decode/1
- Fix pre-existing crash in trust/pipeline.ex: get_in on {:info, tuple} fails
  for slsa_level and pq_signed fields; replace with extract_slsa_level/1 and
  extract_pq_signed/1 pattern-matching helpers
- Retag NIF integration tests as :requires_nif; exclude from default test run
- Fix 57 source files with bare PMPL-1.0 SPDX headers (missing -or-later)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

opsm_ex/lib/opsm/api/nickel.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Api.Nickel do
   @moduledoc """
   Nickel decoding support for API payloads.

opsm_ex/lib/opsm/api/router.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Api.Router do
   @moduledoc """
   Minimal REST API for OPSM UI integration.

opsm_ex/lib/opsm/api/server.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Api.Server do
   @moduledoc """
   Local API server for OPSM UI integration.

opsm_ex/lib/opsm/application.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Application do
   @moduledoc """
   OTP application entrypoint. Starts the registry gateway HTTP server.

opsm_ex/lib/opsm/cache.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Cache do
   @moduledoc """
   ETS-based cache for registry responses.

opsm_ex/lib/opsm/cli.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.CLI do
   @moduledoc """
   CLI entry point for OPSM - Odds-and-sods Package Manager.
@@ -2144,25 +2144,11 @@ defmodule Opsm.CLI do
   end
 
   # Parse the [workspace] members list from an opsm.toml content string.
-  # Returns ["member1", "member2", ...] from the `members = [...]` array.
   defp parse_workspace_members(content) do
-    content
-    |> String.split("\n")
-    |> Enum.reduce({false, []}, fn line, {in_ws, acc} ->
-      stripped = String.trim(line)
-      cond do
-        stripped == "[workspace]" -> {true, acc}
-        String.starts_with?(stripped, "[") and stripped != "[workspace]" and in_ws -> {false, acc}
-        in_ws and String.starts_with?(stripped, "members") ->
-          # members = ["a", "b", "c"] — extract the values
-          values =
-            Regex.scan(~r/"([^"]+)"/, stripped)
-            |> Enum.map(fn [_, m] -> m end)
-          {true, acc ++ values}
-        true -> {in_ws, acc}
-      end
-    end)
-    |> elem(1)
+    case Toml.decode(content) do
+      {:ok, %{"workspace" => %{"members" => members}}} when is_list(members) -> members
+      _ -> []
+    end
   end
 
   # Parse "tool@version" or just "tool" (defaulting to "latest")

opsm_ex/lib/opsm/clients/checky_monkey.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Clients.CheckyMonkey do
   @moduledoc """
   Client for Checky-Monkey code verification service.

opsm_ex/lib/opsm/clients/claim_forge.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Clients.ClaimForge do
   @moduledoc """
   Client for Claim-Forge attestation generation service.

opsm_ex/lib/opsm/clients/palimpsest.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Clients.Palimpsest do
   @moduledoc """
   Client for Palimpsest license analysis service.

opsm_ex/lib/opsm/config.ex

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0
+# SPDX-License-Identifier: PMPL-1.0-or-later
 defmodule Opsm.Config do
   @moduledoc """
   Configuration loading with TOML support.