feat(repo-health): add dependency-license-audit skill with eval suite

[justinmclean]

Summary

• Adds the magpie-dependency-license-audit skill (Triage mode): a read-only audit of a project's direct and transitive dependency tree. It detects the dependency manager(s), resolves each dependency's declared license from ecosystem metadata, classifies each against a configured policy (the ASF three-category A/B/X model or a custom allowlist), and surfaces incompatible, forbidden, and unknown-license dependencies for maintainer review. It never modifies manifests or lock files.
• Supports pip, npm, cargo, maven, gradle, and trivy; policy selectable via --policy asf|allowlist; scope via --repo owner/name or --path.
• Ships a four-step eval suite (scope-selection, license-normalization, license-classification, license-report) with 19 cases, including a prompt-injection case and ambiguous / unknown-license cases.
• Updates the tools/spec-loop/specs/repo-health-family.md spec to describe the new skill.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other:

[justinmclean]

@sebbASF you might be interested in taking a look at this

[potiuk]

Reviewed and merging — the skill and eval suite are solid. I pushed one small doc-only reconciliation on top: the PR shipped the skill but docs/repo-health/README.md, the spec-loop spec, and the config template still described it as "planned / not yet built," and category B was worded three ways. Flipped those to "shipped/experimental" and aligned category-B on the SKILL's own "binary/convenience-binary only" wording. No changes to the skill or evals. Thanks for the skill!