Add ScanCode license scanning workflow

[tbjers]

What

Adds a self-contained License Scan workflow using aboutcode-org/scancode-action, surfaced through the built-in GitHub Actions status badge. This is the intended FOSSA replacement.

Note: FOSSA had no footprint anywhere in the repo — no workflow, badge, or config — so nothing was stripped; this change is purely additive. If a FOSSA GitHub App is installed at the org/repo level, remove it in Settings → Integrations / GitHub Apps (not possible from the codebase).

Changes

• .github/workflows/scancode.yml (new) — runs the scan_codebase pipeline on all pull requests and pushes to main (no path filters, so the badge stays current). Emits JSON/SPDX/CycloneDX SBOMs and enforces check-compliance at ERROR level. Actions are SHA-pinned with version comments, matching ci.yml.
• policies.yml (new) — approves permissive licenses (MIT/Apache/BSD/ISC/etc.), denies copyleft (GPL/AGPL/LGPL) as error. Unlisted licenses fall through as missing, which does not fail at the ERROR level — this avoids false failures from vendored/bundled code (e.g. the committed .github/actions/report/dist/ Octokit bundle) while hard-blocking incompatible licenses.
• README.md — adds the native GitHub Actions status badge for the new workflow.

Verification

• @action-validator/cli passes on the workflow YAML.
• The License Scan check runs on this PR — confirm it completes green and produces the scancode-outputs artifact (SBOMs + license report) in the run summary.
• The README badge renders no status until the first run on main lands after merge.

Notes

• beta is a mutable tag; the action is pinned to its current SHA (e46d127) to freeze behavior. Revisit when scancode-action cuts a newer stable release.

🤖 Generated with Claude Code