chore(audit): add license_cve audit script + initial report

scripts/audit_license_cve.py: 4 internal checks (license +
CVE + pin + source-header), policy tables (allowlist of
permissive/weak-copyleft/public-domain, blocklist of
non-OSI/restricted-source), and a main() that runs all 4
and emits line-per-violation to stdout + a markdown report.

Tests (26 unit + integration) cover license classifier (16
variants across MIT, BSD, Apache, LGPL, MPL, CC0, WTFPL,
GPL, AGPL, SSPL, BSL, Commons Clause, Elastic, Anti-996,
Hippocratic, unknown), pin check (3), source-header check
(3), license check via importlib.metadata (1), CVE check
via subprocess pip-audit (2), and a smoke test of the main
loop (1).

No new pip deps in the project: pure stdlib
(importlib.metadata, tomllib, pathlib, re) + subprocess to
pip-audit (optional dev tool, installed via 'uv tool install
pip-audit' if user wants CVE checks).

Initial report at docs/reports/license_cve_audit/2026-06-07/
records the current state. The Phase 2 commit will apply
the fixes (tilde-pin, delete requirements.txt); the Phase 3
commit will add --strict mode + baseline file for CI.

conductor/tracks/license_cve_audit_20260607/state.toml

@@ -0,0 +1,33 @@
+# Track state for license_cve_audit_20260607
+# Updated by Tier 2 Tech Lead as tasks complete
+
+[meta]
+track_id = "license_cve_audit_20260607"
+name = "License & CVE Audit (Dependency Compliance)"
+status = "active"
+current_phase = 0
+last_updated = "2026-06-07"
+
+[phases]
+phase_1 = { status = "pending", checkpointsha = "", name = "Audit script + initial report" }
+phase_2 = { status = "pending", checkpointsha = "", name = "Tilde-pin + lock regen + delete requirements.txt" }
+phase_3 = { status = "pending", checkpointsha = "", name = "CI gate (--strict + baseline)" }
+phase_4 = { status = "pending", checkpointsha = "", name = "tracks.md update" }
+
+[verification]
+audit_script_exists = false
+license_check_passes = false
+cve_check_optional_passes = false
+pin_check_passes = false
+source_header_check_passes = false
+pyproject_tilde_pinned = false
+requirements_txt_deleted = false
+uv_lock_regenerated = false
+strict_mode_implemented = false
+baseline_file_committed = false
+unit_tests_passing = false
+
+[tasks]
+t0_1 = { status = "completed", commit_sha = "", description = "Create state.toml" }
+t0_2 = { status = "in_progress", commit_sha = "", description = "Create empty scripts/audit_license_cve.py" }
+t0_3 = { status = "in_progress", commit_sha = "", description = "Create empty tests/test_audit_license_cve.py" }