chore: add copyright and SPDX headers

[Caneryy]

Summary

Adds file-level license provenance across repository scripts and documentation for #215 and #216.

• Adds // Copyright (c) 2026 Sub Rosa contributors to all 8 repository scripts from chore: add copyright headers to grant-scoring examples and repository scripts #215 that exist on the current main branch.
• Adds <!-- SPDX-License-Identifier: MIT --> as the first line of all 21 documentation files from chore: add SPDX license headers to documentation files #216 that exist on the current main branch.
• Keeps the change strictly mechanical: 29 files changed, 29 lines added, no deletions, and no runtime or documentation-content changes.

Correct handling of Node shebangs

Four scripts start with a Node shebang. Their copyright notice is placed immediately after the shebang because Node only accepts #! at byte zero; moving the shebang to line 2 produces an Invalid or unexpected token syntax error. Files without shebangs receive the notice on line 1.

Targets absent from the current base branch

Several paths named by the issues were deleted before these issues were opened:

• The eleven examples/grant-scoring/src/* files from chore: add copyright headers to grant-scoring examples and repository scripts #215
• examples/grant-scoring/README.md from chore: add SPDX license headers to documentation files #216
• docs/SCF_PLAN.md from chore: add SPDX license headers to documentation files #216

The grant-scoring surface was removed by bc9c438 (refactor: remove unfocused product surfaces). This PR deliberately avoids resurrecting deleted product or documentation surfaces solely to attach headers.

Verification

• git diff --check
• Exact-header assertions for all 29 changed files
• node --check for all 8 changed scripts
• node --test scripts/check-deploy-docs.test.mjs scripts/check-fixture-sizes.test.mjs scripts/check-threat-model-anchors.test.mjs — 16/16 passed
• node scripts/check-deploy-docs.mjs — passed after the documentation updates
• node scripts/check-fixture-sizes.mjs — passed
• node scripts/check-snapshots.mjs — passed
• node scripts/check-threat-model-anchors.mjs docs/THREAT_MODEL.md — passed after the documentation updates

node scripts/check-links.js reports the pre-existing missing docs/SCF_PLAN.md, which is also one of the stale paths listed by #216. This PR does not restore deleted documentation or alter link-check behavior.

Closes #215
Closes #216