Require the Apache 2.0 notice in every source file - #8

Enforces the Apache 2.0 source notice described in packdb-oss/packdb-sdk#15. One of four PRs (packdb-sdk, packdb-cli, logql-parser, traceql-parser) carrying the same checker and policy document.

What changes

• scripts/check_source_headers.py (checker version 1) is byte-identical in all four repositories. It classifies every tracked file:
  • Source files (.rs, .py, .sh, .bash, and extensionless scripts identified by their shebang) must open with the notice: a Copyright <year> PackDb Contributors line (PackDB also accepted), then Licensed under the Apache License, Version 2.0. The notice goes after any shebang and before Rust //! docs. The full Apache boilerplate is accepted.
  • Declared non-source types (Markdown, TOML, YAML, JSON, text, lockfiles, checksums, LICENSE, CODEOWNERS, .gitignore) are not checked.
  • Anything else fails as unclassified, so a new language cannot be skipped silently.
• scripts/source_header_exceptions.txt lists exceptions as path<TAB>provenance<TAB>reason. It starts empty. An exception that is malformed, a duplicate, or stale (the file is untracked, not source, or now carries the notice) fails.
• scripts/oss-ci.sh checks runs the checker. That makes it part of the required oss-ci / checks job and of the candidate release validation, which runs checks in full. Dependency license auditing stays in cargo deny.
• docs/SOURCE_HEADERS.md documents the policy, scope, exceptions, the local command and the procedure for updating the shared checker. CONTRIBUTING.md and docs/WORKFLOWS.md point to it.
• SPDX identifiers are not an accepted form. Adopting one would be a separate policy decision.

Controls

• Self-test: it runs before every check and covers the accepted short form, the full boilerplate and a year range, scripts with a shebang, and an extensionless script. Each of these must fail it:
  • a missing notice, a notice in a docstring or //! doc, a reversed order, or a foreign copyright holder;
  • a wrong license (MIT text, an MIT SPDX identifier, Apache 1.1);
  • a shebang moved off line 1, or a Rust inner attribute placed before the notice;
  • an unclassified type (.ts, a node shebang, .bin);
  • a malformed or duplicate exception, or a stale exception (untracked, carrying the notice, or not source);
  • an empty scan.
• Mutation check: each of 8 deliberate mutations of the checker logic made the self-test fail.
• Entry point: locally, adding a tracked script without the notice made OSS_CHECK_SCOPE=full scripts/oss-ci.sh checks exit 1 at the header step in all four repositories.

Existing omissions fixed: scripts/check_action_pins.py and scripts/gitleaks-version.sh (the short form used by the sibling scripts, inserted after the shebang; file modes unchanged).