chore(licence): correct stray PMPL SPDX headers to MPL-2.0 in 8 infra files (#432)

## Summary

Owner-directed licence correction (2026-06-26). 8 **standards-authored**
CI/infra files declared `SPDX-License-Identifier: PMPL-1.0-or-later`,
but standards is a sole-owner repo → **MPL-2.0** per the estate licence
classification. Corrected all 8 to `MPL-2.0`.

The repo's own contractile —
`.machine_readable/contractiles/must/Mustfile.a2ml` — already asserts
*"PMPL appears in no standards-authored header (carve-out = 3 repos
only)"*; these 8 files were violating that check.

### Files (SPDX header `PMPL-1.0-or-later` → `MPL-2.0`)
- `.github/workflows/hypatia-scan.yml`
- `.github/workflows/governance.yml`
- `.github/workflows/scorecard-reusable.yml`
- `.github/workflows/hypatia-scan-reusable.yml`
- `.github/workflows/scorecard-enforcer.yml`
- `.github/workflows/governance-reusable.yml`
- `scripts/check-workflow-staleness.sh`
- `scripts/tests/check-workflow-staleness-test.sh`

## Scope discipline
- **Exact full-line replacement on these 8 named files only** — not a
tree-wide SPDX sweep.
- The **palimpsest satellite**
(`rhodium-standard-repositories/satellites/palimpsest-license/**`) is
**untouched** — its PMPL usage is legitimate (the carve-out repo).
- `Mustfile.a2ml` is **not** modified — its `PMPL` string is inside the
enforcement check itself, not a declaration.
- `LICENSES/` keeps `PMPL-1.0-or-later.txt` (still referenced by
satellite content).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---
_Generated by [Claude
Code](https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Governance checks for hyperpolymath repositories — Reusable Workflow
 name: Governance Reusable Workflow
 

.github/workflows/governance.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Governance
 
 on:

.github/workflows/hypatia-scan-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow
 name: Hypatia Reusable Scan
 

.github/workflows/hypatia-scan.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Hypatia Security Scan
 
 on:

.github/workflows/scorecard-enforcer.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer
 

.github/workflows/scorecard-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: OSSF Scorecard Reusable Workflow
 
 on:

scripts/check-workflow-staleness.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 set -eo pipefail
 
 # Staleness checker script for hyperpolymath estate repositories.

scripts/tests/check-workflow-staleness-test.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 set -euo pipefail
 
 # Regression test for check-workflow-staleness.sh (recency-window model).