CI: assert dependency licenses at release time

[the-sarge]

What to build

From the 2026-05-27 multi-agent code review (item H6.d; tracked as F4 in docs/code-review-followups-2026-05-28.md).

dependency-review-action runs only on pull_request events, so license drift on main between PRs (theoretically possible via transitive dependency floating, though go.sum pinning prevents it in practice) is not caught at release time.

Add a go-licenses check (or equivalent) step to the release workflow. Configure the allowed-licenses list — currently BSD-3-Clause, MIT, Apache-2.0, ISC in dependency-gate.yml — once, shared between the two workflows rather than duplicated. The step runs after tag verification (see proposed ADR-0007 for release job ordering) and before SBOM generation, and blocks the release if any direct or transitive dependency carries an unlisted license.

Acceptance criteria

• Release workflow gains a license assertion step (go-licenses check or equivalent)
• Allowed-licenses list defined once and shared/consistent with dependency-gate.yml
• Step ordered after tag verification and before SBOM generation
• Release fails if any direct or transitive dependency has an unlisted license

Blocked by

None - can start immediately