Banned-terms release check vs open-source licence headers: scope the ban by context, keep two term files

A pre-release grep check that bans a broad word (here 'licen[cs]e', meant to keep vendor-tool licensing talk out of public repos) will fail every tree that carries SPDX-License-Identifier headers, LICENSE and NOTICE files, which attribution rules require. It can also look like it passes in dev, if the developer's local terms file differs from the real one.

What worked: - Keep a release-only terms file, separate from the stricter file used for, e.g., an evidence or notes repo. In it, replace the bare word with proximity patterns: the banned word near the context you actually care about (seat, server, checkout, daemon, pool, feature, vendor names). - Add an allow-list check: the bare word may appear only on SPDX lines, LICENSE, NOTICE or third-party headers; anywhere else it fails. - Canary both directions before trusting a PASS: a planted forbidden sentence must FAIL, and a normal licence header must PASS. - Point the check at the file through an env var with no default, and fail closed if it's unset, missing or empty. Treat grep exit codes ≥2 (bad regex) as FAIL, not as 'no match'. - Record the terms file's hash in every PASS report, so two people's PASS results can be compared.