Check license headers across repository

[johnnygreco]

Summary

• add a dedicated CI check for repository license headers
• extend the existing updater to cover handwritten code under projects/
• exclude generated binding directories from header enforcement
• apply the standard SPDX header to existing Python, shell, and CSS project files

Why

License-header enforcement was available as a local script but was not running in CI and did not cover project code. This makes the policy automatic and brings the existing eligible files into compliance.

Validation

• python3 scripts/update_license_headers.py --check (173 eligible files)
• git diff --check
• Egress Gate full checks: 324 tests passed, formatting, lint, type checking, and audit passed
• OpenShell Middleware Manager full checks: 86 tests passed, formatting, lint, type checking, coverage, and build passed
• Reachy Mini: Ruff, Python compilation, and shell syntax passed; its full locked environment is macOS-only
• Robotics Policy Prover: frontend build and two-viewport visual verification passed; Rust tests require cmake, which was unavailable on the validation host