chore(spdx): add MPL-2.0 SPDX headers to 303 source/doc files (#108)

## What
Adds `SPDX-License-Identifier: MPL-2.0` (stapeln's canonical identifier
— 1010 existing uses) to **303 stapeln-owned source/doc files** that
lacked one. This clears the bulk of Hypatia's `missing_spdx` findings —
the largest contributor to the 342 the scan surfaced once #107
re-enabled it.

Per-type comment styles (verified against existing headers): `<!-- -->`
(`.md`), `//` (`.adoc`/`.zig`), `#`
(`.sh`/`.yml`/`.toml`/`.a2ml`/`.nix`/`.ex`/`.exs`), `;` (`.scm`).
Inserted **after shebangs**, and **after YAML frontmatter** for 6
issue-template / `site` `.md` files so GitHub template parsing isn't
broken.

**Deliberately excluded:** generated output (`.cmj`/`.ttm`/`.po`,
`lib/bs/`), comment-less formats (`.json`/`.jsonl`), license texts
(`LICENSES/`, `LICENSE-*`), `.well-known/*` standard files,
`frontend`/`dom-mounter` `.js` (ReScript-migration zone — may be
generated), and the legacy `.res` corpus.

## On the `http://` half — no conversions (intentional)
I investigated all **46** `http://` occurrences; **none should be
converted**. They're all intentional:
- **security-test attack URLs** — `evil.com`, `attacker.com`,
`169.254.169.254` (cloud-metadata SSRF) in `RED-TEAM-EXERCISE.md` /
`OBVIOUS-VULNERABILITIES.md`
- **internal service refs** — `http://backend`, `http://vordr`,
`http://svalinn`, `*.internal`, `*.local`
- the **MPL-2.0 license text** (`mozilla.org`), the **Apple plist DTD
identifier**, `example.org`/`yoursite.com` placeholders
- the **aspect-test that literally greps for `http://`**

Converting any would corrupt security fixtures, break internal refs, or
edit the license. The right resolution for these is a `hypatia:ignore
http_in_docs` pragma or baseline entry — **not** a find-replace. I can
add those pragmas if you want; I didn't do it unprompted since each
needs a per-case reason.

## Verification
303 files changed, 303 insertions (exactly one header each); 0
shebang-placement errors; 0 double headers; frontmatter files
re-checked.

Refs #96.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01EsxEhRW4rDbxMo2c9xaa7Z

---
_Generated by [Claude
Code](https://claude.ai/code/session_01EsxEhRW4rDbxMo2c9xaa7Z)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: hyperpolymath <paraordinate@yahoo.co.uk>

Author: 3 people

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 mcp_servers:
   boj-server:
     command: npx

.github/ISSUE_TEMPLATE/custom.md

@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e

.github/ISSUE_TEMPLATE/documentation.md

@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e

.github/ISSUE_TEMPLATE/feature_request.md

@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d72fe5a14e841ac6d78514b53624b6173038ee20
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4ddc926b4b86451c2711a16bf927ed16ad2db45e

.github/ISSUE_TEMPLATE/question.md

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: MPL-2.0
 # ⚓ ANCHOR: stapeln
 # This is the canonical authority for the stapeln repository.