ci(workflows): presence-gate mirror SSH steps + correct registry-verify licence (#367)

## What

Two workflow-hardening / hygiene fixes flagged by the Hypatia scan.

### 1. `mirror-reusable.yml` — presence-gate the SSH secret (Hypatia
`secret_action_without_presence_gate`, high)
Each forge job (GitLab, Bitbucket, Codeberg, SourceHut, Disroot, Gitea)
ran `webfactory/ssh-agent` gated only on `vars.<FORGE>_MIRROR_ENABLED`,
so an *enabled-but-keyless* mirror would feed an empty key to the action
and fail. Added `if: ${{ secrets.<FORGE>_SSH_KEY != '' }}` to **both**
the `ssh-agent` step and its push step in all 6 jobs — matching the
existing Radicle pattern in the same file. Now a mirror with no
configured key is a clean no-op instead of a hard failure.

### 2. `registry-verify.yml` — licence correction (owner-directed)
SPDX `AGPL-3.0-or-later` → `MPL-2.0`. It was the only one of 28
workflows on AGPL; this aligns it with its siblings and the repo's
sole-owner MPL-2.0 classification, and clears Hypatia's `agpl_license`
finding.

## Not changed (Hypatia false positives, documented)
- **`scorecard_publish_with_run_step` on `scorecard-enforcer.yml`** —
the publish job (`scorecard`) is **already** uses-only, with the
threshold check split into a downstream `check-score` job (there's a
comment documenting exactly this). Hypatia flags `run:` steps elsewhere
in the *file* without scoping to the job.
- **`unpinned_action`** — every `uses:` is SHA-pinned; Hypatia truncates
the SHA and mis-flags. (Foundational fix tracked for the Hypatia repo.)

## Verification
- Both files parse (PyYAML); registry/topology still in sync.
- Diff: +13 / −1, two files.

## Flagged, not swept
Other `AGPL-3.0-or-later` SPDX headers remain in `scripts/*.sh` and
`.github/FUNDING.yml`. Per the manual-only / no-bulk-SPDX guardrail I
did **not** sweep them — surfacing for an explicit decision on whether
they should also go to MPL-2.0.

https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28

---
_Generated by [Claude
Code](https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/mirror-reusable.yml

@@ -60,6 +60,7 @@ jobs:
         with:
           ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
       - name: Mirror to GitLab
+        if: ${{ secrets.GITLAB_SSH_KEY != '' }}
         # continue-on-error: GitLab branch protection on the mirror repo may block
         # force-push even for a deploy key. Owner action required: in GitLab go to
         # Settings → Repository → Protected branches → main and either allow force-push

.github/workflows/registry-verify.yml

@@ -1,4 +1,4 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
+# SPDX-License-Identifier: MPL-2.0
 # registry-verify — fail the build if the spec registry or the DERIVED
 # topology map has drifted from the file tree. This is the in-repo half of
 # the drift-detection loop (the estate half is Hypatia rule HYP-S006).