The license bot service (Dcntrlized/license-bot) is authoritative: it amends
missing AGPL headers into the PR head commit, including for fork PRs, and
reports the license-bot / addlicense commit status. This workflow now only
reports an honest advisory signal, holds no secrets and never writes.