ci: verify dependency license evidence

[AlexStocks]

Summary

• add release licenses, which reads a built binary's actual Go build info and verifies top-level license/notice evidence for every linked module
• write a bounded JSON dependency-license manifest and report module/native dependency counts
• add an idempotent make license-dependencies target for the standard binary
• add a stable license-dependencies CI job that uploads the JSON evidence for 14 days
• add a real-binary regression test and extend the workflow topology contract

Rationale

WP0-C in #3 requires dependency license evidence before release packaging. The repository already uses collectLicenses during release archive creation; this change exposes that same implementation for ordinary pull requests rather than creating a second license scanner.

This PR is stacked on #35 (codex/issue-33-portable-sdk), which owns the portable SDK gate. It intentionally does not depend on the duplicate #34 chain.

Behavior, API, and compatibility

• no public API, protocol, generated-contract, or runtime behavior changes
• fails when a module referenced by the built standard binary is unavailable in the Go module cache or lacks a top-level license/notice file
• standard evidence includes the embedded sqlite-vec license; Full native assets remain validated through the release packaging path

Validation

• make license-dependencies run twice, both times producing a manifest with 95 Go modules and 1 native dependency
• JSON manifest structural check via jq
• go test ./...
• make check with the required SQLite include path
• make check-generated
• make license-check
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• git diff --cached --check

Exact head validated: d6eed940a60eed44a2e98fbecdb3a91c5ec08133.

AI usage

Implemented with Codex assistance. The real-binary test and generated evidence path were self-reviewed with test-guard and verified by the commands above.