fix(ci): make CI green on main — lockfile, SPDX headers, doctor key, lint

[ProtocolWarden]

Three independent root causes were turning CI red on main:

• test (3.11/3.12): uv sync failed resolving a stale uv.lock. The lock
  pinned an old OperationsCenter commit whose transitive dependency name
  (executor-runtime) no longer matched the upstream package's renamed
  metadata (core-runner), so uv aborted with a name-mismatch error.
  Regenerated the lock (uv lock --upgrade) to track current upstream,
  which now resolves core-runner from its renamed source. This also
  unmasked latent ruff failures the install error had been hiding:

  • I001/F401 import sorting + unused imports: applied ruff --fix.
  • B017 (pytest.raises(Exception)): narrowed to pydantic.ValidationError,
    the exception these frozen-model / validation tests actually assert.

• License headers: two empty package-init files lacked the SPDX header.
  Added the repo's exact two-line AGPL-3.0-or-later header to
  test/unit/switchboard/init.py and .../contracts/init.py.

• Custodian doctor: audit.reconcile_enforce is consumed by the R1/R2
  reconcile detector but is absent from custodian-doctor's built-in
  known-audit-key list, producing a spurious "unknown audit key" warning
  under --strict. Declared it via plugin_audit_keys (the documented
  escape hatch); the key stays active, no check is disabled.

Verified locally (Python 3.11): uv sync, ruff check src test,
pytest (347 passed), check_docs.sh, and custodian-doctor --strict all pass.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com