Add fail-closed runtime dependency license evidence

[Claudio9701]

Outcome

Adds deterministic, fail-closed license evidence for the installed UrbanPy runtime closure while explicitly preserving FOSSA as the independent EL-BID compliance gate.

What changed

• walks active runtime requirements from installed UrbanPy metadata rather than reporting unrelated dev tools
• prefers PEP 639 expressions and normalizes legacy classifier evidence without hiding compound terms
• requires every exact observed license string to be reviewed in license-policy.toml
• fails on new packages, unknown metadata, or changed license strings
• records narrow primary-source dispositions for defopt (missing wheel metadata; official MIT license) and text-unidecode (explicitly selects its offered GPLv2+ option)
• uploads locked requirements and JSON license evidence on every CI run
• includes the same report with the release CycloneDX SBOM and attested distributions
• documents the remaining FOSSA/legal reconciliation responsibility

Verification

• 89 locked runtime packages approved with deterministic evidence
• 3 closure/policy regression tests passed
• full suite: 62 passed, 2 deselected
• Ruff clean
• Trunk checked 130 files with no issues

Important compliance boundary

This engineering policy does not dismiss or suppress any of FOSSA's 95 reported items. FOSSA remains required and blocking. EL-BID maintainers must reconcile its wider source, development, generated, and vendored findings and obtain legal disposition where needed.

Stack

Base: #89
Roadmap: #61
Parent: #65

Closes #90