fix(license): give each file the copyright line of whoever wrote it

[rodrigorjsf]

Closes #95.

Every file in this fork carrying an SPDX header asserted NVIDIA's copyright, including the ones the
fork wrote. Apache-2.0 §4(c) requires retaining upstream's notices, not extending them to work
upstream did not do — and §4(b) requires a modified file to say it was modified. This corrects both.

The blocking decision

#95 could not run until the maintainer chose the copyright line for fork-authored files. They chose
Copyright (c) 2026 SkillSpector-Polyglot contributors, which is the line
.claude/rules/license-compliance.md already proposed, so the rule's stated target is unchanged and
the sweep implements it as written.

What was measured

Classified against upstream/main at merge-base a818f50 with git diff --diff-filter, never by
path — a blanket rewrite over src/ would reach tests/fixtures/, whose files are analyzer input.

Bucket	Header now
Fork-authored	the fork's line only
Inherited, modified here	NVIDIA's line, then the fork's
Inherited, untouched	unchanged

The three counts add up to the full header population in scope, which is the audit's completion
criterion. /license-audit re-measures them; this PR deliberately does not write the numbers
into a durable doc, because a count in prose rots on the next upstream merge and #95's own body
rotted exactly that way.

Twelve headerless .py fixtures under tests/fixtures/ stay headerless. A header there is content
the Scan reads, and adding one would move that fixture's Behavior Snapshot for a reason unrelated to
licensing.

§4(b) where a header cannot reach

Makefile, pyproject.toml, README.md and docs/ have no comment syntax to carry a per-file
notice. The §4(b) notice for those is a README.md Transparency bullet stating that this fork
modifies inherited files; the rule and /license-audit both now say so, and the skill checks the
bullet is still present.

#95's option 1 proposed a root MODIFICATIONS.md in addition to per-file headers. This PR does
not add one — it would duplicate what the headers already state for the files that have them, and
would need re-enumerating on every upstream merge. The README bullet covers the remainder without
carrying a list.

Third-party notices

tree-sitter and tree-sitter-java, both MIT, with copyright lines read from the installed
dist-info license files rather than recalled — tree-sitter is "Max Brunsfeld, GitHub", and
tree-sitter-java is 2017, both different from the plausible guess.

Four further runtime dependencies are missing from that file — langchain-anthropic,
langchain-aws, boto3, langsmith — all introduced upstream before the merge-base. That is an
inherited omission and out of #95's stated scope, so it is filed as #102 rather than folded in here.

Deliberate narrowing

#95 asked for the classification script to be committed under contrib/. It is not. /license-audit
did not exist when #95 was filed and now automates the classification, the arithmetic check, the
notices comparison and the §4(d) check; a committed one-off script would be a second copy of it.
The sweep ran from a throwaway script instead. The audit skill is the re-runnable artifact.

/license-audit also gained a scope fix this PR exposed: it classified over src tests contrib,
which misses the header under scripts/release/. It now covers scripts too, and stays scoped
rather than going unscoped — a bare recursive grep matches the documentation about headers and
counts prose as source.

Verification

• make update-snapshots then git status: no snapshot modified, no tests/fixtures/ file touched.
• make test-unit: 2662 passed, 12 skipped, 4 xfailed.
• make lint, make format-check: clean.
• LICENSE byte-identical to upstream (git diff $MB HEAD -- LICENSE empty); upstream ships no
  NOTICE, re-checked against upstream/main, so §4(d) has nothing to propagate.

Reviewed on both axes by /code-review; every finding from both passes is fixed on this branch.