chore: fix license headers to PMPL-1.0-or-later

- Update SPDX identifiers from AGPL to PMPL
- Ensure LICENSE file uses PMPL-1.0-or-later
- Maintain consistency with palimpsest-license repo

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Your Name

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # For most projects, this workflow file will not need changing; you simply need
 # to commit it to your repository.
 #

.github/workflows/container-policy.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Container Policy
 on: [push, pull_request]
 jobs:

.github/workflows/guix-nix-policy.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Guix/Nix Package Policy
 on: [push, pull_request]
 jobs:

.github/workflows/jekyll-gh-pages.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # Sample workflow for building and deploying a Jekyll site to GitHub Pages
 name: Deploy Jekyll with GitHub Pages dependencies preinstalled
 

.github/workflows/quality.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Code Quality
 on: [push, pull_request]
 

.github/workflows/rsr-antipattern.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # RSR Anti-Pattern CI Check
 # SPDX-License-Identifier: PMPL-1.0
 #

.github/workflows/scorecard.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: OSSF Scorecard
 on:
   push:

.github/workflows/security-policy.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Security Policy
 on: [push, pull_request]
 jobs:
@@ -24,7 +25,7 @@ jobs:
           fi
           
           # Block hardcoded secrets patterns
-          SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
+          SECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["'][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)
           if [ -n "$SECRETS" ]; then
             echo "❌ Potential hardcoded secrets detected!"
             FAILED=true

.github/workflows/ts-blocker.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: TypeScript/JavaScript Blocker
 on: [push, pull_request]
 jobs:

.github/workflows/wellknown-enforcement.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Well-Known Standards (RFC 9116 + RSR)
 on:
   push:
@@ -80,7 +81,8 @@ jobs:
       - name: DNS security records check
         if: hashFiles('CNAME') != ''
         run: |
-          DOMAIN=$(cat CNAME 2>/dev/null | tr -d '\n')
+          DOMAIN=$(cat CNAME 2>/dev/null | tr -d '
+')
           if [ -n "$DOMAIN" ]; then
             echo "Checking DNS for $DOMAIN..."
             # CAA record