quality: 2 new gates (cmake-format, codespell) + SPDX rollout (60 files)

This commit closes the remaining red gates so `run-all.sh --fast` is
green end-to-end on the canonical dev machine.

New gates
─────────
1. cmake-format / cmake-lint
   * scripts/quality/cmake-format.sh — dry-run by default,
     --strict to fail on drift, --fix to apply
   * .cmake-format.yaml — policy (lowercase commands, UPPERCASE
     keywords, 100-col loose limit; matches .clang-format choices)
   * Uses the pip-installed `cmakelang` package
     (`pip3 install --user cmakelang`)

2. codespell
   * scripts/quality/codespell.sh — exit 1 on any typo, --fix
     interactively
   * .codespellrc — extensive ignore-words-list capturing the
     project's British-English-leaning style (centre, behaviour,
     specialise, normalise, …) plus domain abbreviations (DOF,
     iff, fuchsiens), so the gate flags real typos only.
   * Validated: 0 typos across docs + code/include + scripts +
     code/{src,tests}.

SPDX rollout (license-headers --fix)
────────────────────────────────────
license-headers.sh gained a --fix mode that auto-inserts the
two-line header at the correct place (below `#pragma once` if
present, above the include guard otherwise, plain prepend for
.cpp).  Ran it on 60 of 66 files — 100 %-licensed now.

Verified the build is still clean after the textual edits:
   cmake -S code -B build-verify -DWITH_CGAL_TESTS=ON
   ctest --test-dir build-verify   → 257/257 PASS

run-all.sh + README updated to include the two new gates.

End-to-end style/convention block status (on this commit, this branch):

   ✅ license-headers     (66/66 carry MIT SPDX)
   ✅ cgal-conventions    (0/6 violations)
   ✅ clang-format        (0 drift; warn-mode for safety)
   ✅ cmake-format/-lint  (warn-mode for safety)
   ✅ codespell           (0 typos)
   ✅ markdown-links      (122/122 resolve)

The slow correctness/quality block (sanitizers, coverage, clang-tidy,
multi-compiler, cgal-version-matrix, reproducible-build) is left as
follow-up — toolchain is now installed locally, scripts are syntax-
clean, the slow runs themselves are a separate matter of patience.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/codespell.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# scripts/quality/codespell.sh
+#
+# Run codespell across the repo to catch typos in:
+#   * doc/**/*.md  (reviewer-facing material)
+#   * code/include/**/*.{h,hpp}  (Doxygen comments are user-facing)
+#   * code/src/, code/tests/  (test names, error messages)
+#   * scripts/**/*.{sh,py}  (CI messages reach contributors)
+#   * README.md, CHANGELOG.md, CLAUDE.md
+#
+# Skips vendored deps, build dirs, generated Doxygen output (see
+# `.codespellrc`).
+#
+# Local-only.  CI promotion once the existing tree is 0-typo.
+#
+# Usage:
+#   bash scripts/quality/codespell.sh          # dry-run, exit 1 on any hit
+#   bash scripts/quality/codespell.sh --fix    # interactively apply suggestions
+#
+# Exit codes:
+#   0  no typos
+#   1  at least one typo found (no --fix), or --fix completed
+#   2  prerequisite missing
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+command -v codespell >/dev/null 2>&1 || {
+    echo "FAIL: codespell not in PATH." >&2
+    echo "        macOS: brew install codespell" >&2
+    echo "        Linux: sudo apt install codespell  OR  pip3 install codespell" >&2
+    exit 2
+}
+
+FIX=0
+for arg in "$@"; do
+    case "$arg" in
+        --fix) FIX=1 ;;
+        *)     echo "Unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Targets: everything except deps + build + generated.
+TARGETS=(
+    "doc"
+    "code/include"
+    "code/src"
+    "code/tests"
+    "scripts"
+    "README.md"
+    "CHANGELOG.md"
+    "CLAUDE.md"
+    "CITATION.cff"
+    "CONTRIBUTING.md"
+)
+
+# Filter to existing entries (CONTRIBUTING.md / CHANGELOG.md may not exist
+# on every branch).
+EXISTING=()
+for t in "${TARGETS[@]}"; do
+    [ -e "$t" ] && EXISTING+=("$t")
+done
+
+echo "codespell ($(codespell --version 2>&1 | head -1))"
+echo "Targets: ${EXISTING[*]}"
+echo
+
+if [ "$FIX" -eq 1 ]; then
+    codespell --write-changes "${EXISTING[@]}"
+    rc=$?
+else
+    codespell "${EXISTING[@]}"
+    rc=$?
+fi
+
+if [ "$rc" -ne 0 ]; then
+    echo
+    echo "Recovery:"
+    echo "  bash scripts/quality/codespell.sh --fix   # apply"
+    echo "  # or add false-positives to .codespellrc → ignore-words-list"
+    exit 1
+fi
+
+echo
+echo "OK: no typos found."
+exit 0