chore: add a shared license-audit skill and Codex agent - #301

Summary

Add a shared license-audit skill for reviewing Asyncband checkouts and release artifacts. Keep the audit workflow in .agents/skills/license-audit/SKILL.md, with a small Codex license_auditor entry point. Link the shared workflow from AGENTS.md and the existing release runbook.

The review helps the release manager understand existing licensing arrangements, investigate questions, and compare practical options. It returns evidence and suggestions without modifying audited files; release decisions remain with the release manager and project community.

Include Markdown in the license-header check and add ASF headers to existing Markdown documents. Clarify how repository paths in the shared root LICENSE map into the published crate, preserving the existing symlinks and a single maintained source for licensing materials.

Design Notes

The skill is adapted from Apache Magpie's license-compliance-audit without its setup, adopter configuration, Markdown tooling, or sibling skills. Codex retains its native custom-agent configuration, while the review method remains available to other coding agents through the shared Markdown skill.

Account for actual bundled works and Cargo packaging conventions. Distinguish clear omissions from optional improvements and incomplete evidence, and consider maintenance costs when proposing changes.

SKILL.md requires YAML frontmatter first. Its ASF header follows the frontmatter; a documented exception keeps HawkEye from prepending a header and breaking discovery. Other Markdown files remain covered by the normal header check.

Validation

• cargo x lint passed.
• Skill Creator validation passed for the shared skill.
• HawkEye accepted the skill's ASF header when checked after removing frontmatter in a temporary copy.
• Native Codex 0.153.4 discovered the shared skill and invoked the configured license_auditor for a bounded Cargo-package review.
• Verified the generated crate contains exact regular-file copies of LICENSE, NOTICE, and DISCLAIMER, and that all 25 documented crate source paths resolve.