chore(spdx): migrate 25 workflow SPDX headers PMPL-1.0-or-later → MPL-2.0 (#249)

## Summary

- All 25 reusable+caller workflow files in `.github/workflows/` carried
legacy `PMPL-1.0-or-later` SPDX identifiers.
- Estate licence policy (2026-05-25) mandates **MPL-2.0** estate-wide;
`PMPL-1.0`/`-or-later` is on the migration list.
- Bulk `sed`-replace, no functional change.
- The `scorecard-reusable.yml` prose comment that references PMPL as a
drift pattern is left untouched (meta-reference, not declaration).

## Follow-up

Hypatia `cicd_rules/@wrong_licenses` will be updated separately to flag
`PMPL-1.0` / `PMPL-1.0-or-later` so the scanner enforces this drift
detection in future.

## Test plan

- [x] No code paths touched
- [ ] CI workflows green on this PR (canonical reusable workflows are
self-checking)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/affinescript-verify.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: AffineScript Verify
 # Direct pushes only on integration branches. Feature-branch validation
 # is fully covered by pull_request — running a full AffineScript verify

.github/workflows/boj-build.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.

.github/workflows/casket-pages.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: GitHub Pages
 
 on:

.github/workflows/codeql-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # codeql-reusable.yml — Reusable CodeQL security-analysis workflow.
 #
 # Consolidates the per-repo `codeql.yml` workflow (estate-wide: 263

.github/workflows/codeql.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: CodeQL Security Analysis
 
 on:

.github/workflows/deno-ci-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # deno-ci-reusable.yml — Reusable Deno CI bundle (RSR).
 #
 # Replaces the per-repo `rescript-deno-ci.yml` template that copy-drifted

.github/workflows/doc-format.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 name: Documentation Format Enforcement
 
 on:

.github/workflows/echidna-verify.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # ECHIDNA proof verification — formal verification of Agda and Idris2 proofs.
 #
 # Scope:

.github/workflows/elixir-ci-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # elixir-ci-reusable.yml — Reusable Elixir CI bundle (RSR).
 #
 # Replaces the per-repo `elixir-ci.yml` template that copy-drifted (and

.github/workflows/governance-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # governance-reusable.yml — Reusable estate governance bundle (RSR).
 #
 # This is a `workflow_call` reusable workflow: downstream repos invoke it with