License audit: SPDX headers + per-file provenance (closes 7cbbf97)

Add SPDX-License-Identifier to every source file in lib/ and cli/.
Files derived from Bobrowski's libunuc2 retain LGPL-3.0-only;
cli/src/main.c (derived from his GPL-licensed unuc2 tool) and all
new Phase 2-7 work by Valetov are GPL-3.0-or-later.  No silent
LGPL-to-GPL upgrade has been applied.

CREDITS.md now lists each Bobrowski-derived file specifically rather
than crediting libunuc2 as generic 'inspiration'.

docs/license-audit.md records the full per-file provenance table,
the LGPL-3.0 -> GPL-3.0 chain rationale (LGPL sec. 4 Combined Works
is the operative clause; LGPL sec. 3 single-direction upgrade is
documented but not exercised), and confirms that:
- the 2015 LGPL-3.0 release in original/UC2_source/ is preserved
  unchanged;
- the 2020-2021 LGPL/GPL releases in original/unuc2-0.6/ are preserved
  unchanged;
- lib/src/super.bin is bit-identical to upstream and to de Vries's
  1992 distribution data.

lib/include/uc2/libuc2.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: LGPL-3.0-only */
+
 #ifndef LIBUC2_H
 #define LIBUC2_H
 

lib/include/uc2/uc2_blake3.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* BLAKE3 cryptographic hashing for archive integrity.
  *
  * BLAKE3 is a fast cryptographic hash based on the Bao tree hashing

lib/include/uc2/uc2_blockstore.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Cross-archive block store for content-addressable deduplication.
  *
  * Stores unique CDC chunks indexed by 64-bit content hash.  Multiple

lib/include/uc2/uc2_cdc.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Content-defined chunking (CDC) for UC2 deduplication.
  *
  * Uses the Gear rolling hash for fast, content-aware chunk boundary

lib/include/uc2/uc2_delta.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Delta compression for file versioning.
  *
  * Computes a compact binary delta between a source (old) and target

lib/include/uc2/uc2_dict.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Dictionary management for zstd-inspired dictionary compression.
  *
  * Formalizes UC2's master blocks as proper dictionaries with content

lib/include/uc2/uc2_lz4.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* LZ4-compatible ultra-fast compression.
  *
  * Minimal LZ4-like compressor optimized for speed over ratio.

lib/include/uc2/uc2_merkle.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Merkle DAG for content-addressable deduplication.
  *
  * Builds a Merkle tree from CDC chunks: each file is represented as a

lib/include/uc2/uc2_ots.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* OpenTimestamps integration.
  *
  * UC2 stores an OpenTimestamps proof in a magic-bracketed sidecar

lib/include/uc2/uc2_preprocess.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Content-aware preprocessing filters for improved compression.
  *
  * These transforms are applied BEFORE compression to expose redundancy

lib/include/uc2/uc2_rans.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* rANS (range Asymmetric Numeral Systems) entropy coder.
  *
  * Drop-in replacement for Huffman coding with ~5-15% better compression

lib/include/uc2/uc2_sha256.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* SHA-256 (FIPS 180-4) -- pure C implementation.
  *
  * Used by the OpenTimestamps integration; calendars accept SHA-256

lib/include/uc2/uc2_simhash.h

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later */
+
 /* Near-duplicate detection via SimHash.
  *
  * SimHash produces a fixed-size fingerprint where similar documents