chore: add ASF source headers and a RAT release gate

[M4n5ter]

English

Part of #2974 — G4: source headers and RAT.

Outcome

Apply the agreed ASF source-header policy and enforce it with an automated audit
of the source release candidate.

Exit criteria

• Define the file types, generated files, third-party files, fixtures, and
  other justified exclusions covered by the header policy.
• Add ASF license headers to applicable tracked source files.
• Record the mechanical header-only change in .git-blame-ignore-revs if
  the project decides that is appropriate.
• Add Apache RAT or an equivalent mentor-approved audit with a reviewed
  exclusion list.
• Run the audit against the extracted source archive, not only the Git
  checkout.
• Make the release workflow fail on an unexpected unapproved file.
• Update DISCLAIMER-WIP when its missing-header disclosure is no longer
  true.

Existing work

PR #3397 implements this gate. The boxes above record what that pull request
does; none of it is on main until it merges.

Two exit criteria stay open on purpose:

• The audit is an equivalent Node implementation rather than Apache RAT. The
  reasoning is in the pull request, and it needs mentor confirmation before it
  counts as the "mentor-approved equivalent" this issue asks for.
• .git-blame-ignore-revs carries the placeholder entry the file's own
  convention requires. Because this repository squash-merges, the landed hash
  goes in a follow-up right after the merge: a hash that never reaches main
  makes git blame fail outright.

Out of scope

• Rewriting NOTICE or auditing third-party license classifications.
• General formatting or unrelated source cleanup.

References

• ASF source header policy
• Apache Creadur RAT
• Incubator release management

Ownership

Leave this issue unassigned until explicitly claimed.

简体中文

#2974 的一部分——G4：源码 headers 与 RAT。

目标结果

落实约定的 ASF 源码 header 策略，并通过源码 RC 的自动化审计持续执行。

完成条件

• 定义 header 策略覆盖的文件类型，以及 generated files、third-party files、
  fixtures 和其他合理排除项。
• 为适用的已跟踪源文件添加 ASF license headers。
• 如果项目认为合适，将纯机械 header 变更记录到 .git-blame-ignore-revs。
• 添加 Apache RAT 或 mentors 认可的等效审计，并使用经过审查的排除清单。
• 对解压后的源码归档运行审计，而不只是检查 Git checkout。
• 出现未预期且未经批准的文件时，让发版 workflow 失败。
• 当缺少 header 的问题解决后，更新 DISCLAIMER-WIP 中不再成立的披露。

已有工作

PR #3397 实现了这一 gate。上面的勾选记录的是该 PR 的内容；在它合入之前，这些都不在
main 上。

有两条完成条件是有意保持开放的：

• 审计采用等效的 Node 实现而非 Apache RAT。理由写在 PR 描述里，需要 mentor 确认后
  才算本 issue 要求的"mentors 认可的等效审计"。
• .git-blame-ignore-revs 目前只有该文件自身约定要求的占位条目。由于本仓库采用
  squash-merge，落地 hash 需要在合并后的 follow-up 中补上：main 上不存在的 hash 会
  让 git blame 直接报错。

不在范围内

• 重写 NOTICE 或审计第三方许可证分类。
• 一般格式化或无关源码清理。

参考资料

• ASF 源码 header 政策
• Apache Creadur RAT
• Incubator 发版管理

负责人边界

明确认领前保持 unassigned。

[Astro-Han]

Claiming this.

Draft PR: #3397

It applies the header policy and enforces it with an audit that runs inside the extracted source archive, reusing the G2 archive path from #3278/#3332 rather than adding a second one. Two commits: policy + audit + release gate, then the mechanical sweep.

Two points that need a decision rather than more code:

1. RAT equivalence. The PR implements an equivalent Node audit instead of Apache RAT. Reasons are in the PR description; the short version is that RAT would add a JVM and a downloaded jar to the path a voter is expected to reproduce, and its glob exclusions fail open, while this audit fails closed on any file that matches neither a header rule nor a reviewed exclusion. This still needs mentor confirmation to count as the "mentor-approved equivalent" this issue asks for. If mentors want literal RAT output, the policy data carries over to a rat-excludes file, but the fail-closed property does not.

2. .git-blame-ignore-revs. That file's own convention requires hashes that exist on main, and this repository squash-merges, so the PR adds the placeholder entry and the landed hash goes in a follow-up right after the merge. An unknown hash makes git blame fail outright.

The exclusion list is the part that needs human review, not the header insertion — npm run check:asf-headers -- --report prints every rule with its justification and the exact files it claims.

Merging the sweep will require open pull requests to rebase.

Prepared with Claude Code; the exclusion rules and their justifications are AI-drafted and need a human contributor of record to confirm them.