fix(ci): make CI green — add missing SPDX header + satisfy custodian-doctor

Two pre-existing failures on main:

- License headers: tools/platform_deployment_cli/__main__.py lacked the
  SPDX-License-Identifier header. Added the repo-standard SSPL-1.0 header
  matching the existing style.

- Custodian doctor: custodian-doctor --strict flagged audit.reconcile_enforce
  as an unknown audit key. The reconcile detector (R1/R2) reads that key
  directly, but the doctor's _KNOWN_AUDIT_KEYS allow-list omits it (upstream
  gap). Declared it via the doctor's own plugin_audit_keys escape hatch, which
  validates the config without changing R1/R2 enforcement behavior.

Verified locally: both CI commands pass and `pytest -q` still passes (172).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ProtocolWarden

.custodian/config.yaml

@@ -34,6 +34,12 @@ audit:
   # Reconcile detectors R1/R2 enforced — this repo's tracked .console/ has been
   # reconciled (scrub-target leaks genericized; log under budget, no prune needed).
   reconcile_enforce: true
+  # The reconcile detector reads `reconcile_enforce` directly, but custodian-doctor's
+  # _KNOWN_AUDIT_KEYS allow-list omits it (upstream gap), so --strict flags it as a
+  # typo. Declare it via the doctor's own plugin_audit_keys escape hatch so the
+  # config validates without changing R1/R2 enforcement behavior.
+  plugin_audit_keys:
+    - reconcile_enforce
   # PlatformDeployment docs frequently reference symbols and values that live in
   # OTHER repos (TeamExecutor, DAGExecutor, OperationsCenter) since WS hosts adapter
   # integration documentation. These aren't phantoms — they're cross-repo

tools/platform_deployment_cli/__main__.py

@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: SSPL-1.0
+# Copyright (C) 2026 ProtocolWarden
 from platform_deployment_cli.main import main
 
 main()