chore: adopt the Kaiten licensing pack and the DCO

[Alex (Alexkuva)]

The licensing and contribution files every Kaiten SDK ships, from the pack in kaitencloud/brain (licence/sdk), as sdk-python, sdk-js and cli already do. Steps 1, 2, 3 and the first half of 5 of the pack's README.

File	What
LICENSE	The apache.org text, byte for byte. The previous one reworded section 9; SPDX tools do not recognise that, nor does pkg.go.dev, which reads the file to decide whether it may show the documentation
NOTICE	Kaiten SDK for Go / Copyright 2026 KAITEN INC
DCO.md, CONTRIBUTING.md, SECURITY.md	The DCO 1.1, how to sign off and fix a missing sign-off, the two private channels for vulnerabilities
.github/CODEOWNERS	* @kaitencloud/engineering: the ruleset already requires code-owner review, and until now had no owner to ask
.github/PULL_REQUEST_TEMPLATE.md	With the DCO checklist line
.github/workflows/dco.yml	The DCO check, identical to the other repositories'. It runs from main (pull_request_target), so it starts judging pull requests once this is merged
45 .go files	Open with // Copyright 2026 KAITEN INC and // SPDX-License-Identifier: Apache-2.0, followed by a blank line so the header stays out of the package doc
Taskfile.yml	task generate and task generate:platform write the header on the generated clients: oapi-codegen has no option for it
headers_test.go	TestLicenseHeaders fails on any Go file without the header, generated ones included
README.md	The pack's license section, and the sign-off in the contributing section

Go has no package metadata to declare: the module's LICENSE is the declaration.

Order

• After ci: report lint, build and test as separate checks #2. Until ci: report lint, build and test as separate checks #2 is merged, this pull request still gets the old Lint, Build & Test check, and the ruleset blocks it. Re-run its checks once ci: report lint, build and test as separate checks #2 is on main.
• Then, outside this repository:
  • require_dco = true for sdk-go in kaitencloud/infra-scm, which adds DCO to the ruleset;
  • Require contributors to sign off on web-based commits in the settings. It is on in sdk-python, sdk-js and cli, not here.

Checked

• go vet, go build and go test -race -shuffle=on -cover ./....
• golangci-lint v2.12.2: 0 issues, and its formatters leave the tree unchanged.
• go mod tidy leaves go.mod and go.sum unchanged.
• TestLicenseHeaders fails when a file loses its header.
• The license-header task, run with Task 3.51 on a generated file.
• LICENSE, DCO.md, SECURITY.md, CODEOWNERS, the template and dco.yml are byte-identical to the pack.

🤖 Generated with Claude Code · ✅ Tested and approved by Alex (@Alexkuva), maintainer