Add the licence policy, and enforce permissive-only dependencies

Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Nothing recorded that
before: our own crates and npm packages carried no licence field at all,
which made `cargo deny` report them as `unlicensed` errors and left the
actual policy nowhere.

docs/LICENSES.md is the policy and lives here because it is the repo both
other tiers already depend on. It covers the allow/deny list, the
2026-09-17 audit of all six repos (no copyleft reaches any binary), and
the three categories `cargo deny` structurally cannot see: external
binaries we spawn or ship, ML model weights, and self-hosted server
software whose licence is not its client library's.

Two findings in there are worth more than the tooling: Redis 7.4+ is
RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's
print-failure model are both AGPL-3.0 - the obvious choice in each case
is the one we cannot ship.

Crates declare `LicenseRef-Proprietary` with `publish = false`; that
string is deliberately not valid SPDX so it must never enter an allow
list. npm packages use `"license": "UNLICENSED"`.

deny.toml

@@ -0,0 +1,36 @@
+# Licence policy for a closed-source commercial product.
+# See docs/LICENSES.md in continuum-common for the rationale and the
+# non-cargo dependencies (external binaries, ML models) this file cannot see.
+#
+# Run: cargo deny check licenses
+
+[licenses]
+# Permissive only. Anything copyleft reaching a shipped binary would make
+# the product undistributable without releasing our source.
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unicode-3.0",
+    "Unlicense",
+    "MPL-2.0",
+    "CC0-1.0",
+    "BlueOak-1.0.0",
+]
+confidence-threshold = 0.9
+
+# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
+# an SPDX identifier and must never appear in the allow list above - a
+# third-party crate claiming it would be a real finding. They are recognised
+# as first-party by `publish = false` in their manifests.
+private = { ignore = true }
+
+[bans]
+deny = []
+
+[advisories]
+yanked = "deny"