quality: 2 new gates (cmake-format, codespell) + SPDX rollout (60 files)

This commit closes the remaining red gates so `run-all.sh --fast` is
green end-to-end on the canonical dev machine.

New gates
─────────
1. cmake-format / cmake-lint
   * scripts/quality/cmake-format.sh — dry-run by default,
     --strict to fail on drift, --fix to apply
   * .cmake-format.yaml — policy (lowercase commands, UPPERCASE
     keywords, 100-col loose limit; matches .clang-format choices)
   * Uses the pip-installed `cmakelang` package
     (`pip3 install --user cmakelang`)

2. codespell
   * scripts/quality/codespell.sh — exit 1 on any typo, --fix
     interactively
   * .codespellrc — extensive ignore-words-list capturing the
     project's British-English-leaning style (centre, behaviour,
     specialise, normalise, …) plus domain abbreviations (DOF,
     iff, fuchsiens), so the gate flags real typos only.
   * Validated: 0 typos across docs + code/include + scripts +
     code/{src,tests}.

SPDX rollout (license-headers --fix)
────────────────────────────────────
license-headers.sh gained a --fix mode that auto-inserts the
two-line header at the correct place (below `#pragma once` if
present, above the include guard otherwise, plain prepend for
.cpp).  Ran it on 60 of 66 files — 100 %-licensed now.

Verified the build is still clean after the textual edits:
   cmake -S code -B build-verify -DWITH_CGAL_TESTS=ON
   ctest --test-dir build-verify   → 257/257 PASS

run-all.sh + README updated to include the two new gates.

End-to-end style/convention block status (on this commit, this branch):

   ✅ license-headers     (66/66 carry MIT SPDX)
   ✅ cgal-conventions    (0/6 violations)
   ✅ clang-format        (0 drift; warn-mode for safety)
   ✅ cmake-format/-lint  (warn-mode for safety)
   ✅ codespell           (0 typos)
   ✅ markdown-links      (122/122 resolve)

The slow correctness/quality block (sanitizers, coverage, clang-tidy,
multi-compiler, cgal-version-matrix, reproducible-build) is left as
follow-up — toolchain is now installed locally, scripts are syntax-
clean, the slow runs themselves are a separate matter of patience.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/license-headers.sh

@@ -28,6 +28,53 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
 SPDX="SPDX-License-Identifier: MIT"
+COPYRIGHT="Copyright (c) 2024-$(date +%Y) Tarik Moussa."
+
+FIX=0
+for arg in "$@"; do
+    case "$arg" in
+        --fix) FIX=1 ;;
+        *) echo "Unknown arg: $arg (only --fix supported)" >&2; exit 2 ;;
+    esac
+done
+
+# Insert a 2-line header at the top of $1, but BELOW any existing
+# `#pragma once` so the include-guard role is preserved.  Idempotent —
+# the caller has already verified the SPDX line is missing.
+insert_header () {
+    local f="$1"
+    local tmp
+    tmp="$(mktemp)"
+    local first_line
+    first_line="$(head -1 "$f")"
+    if echo "$first_line" | grep -q "^#pragma once"; then
+        # Header form 1: keep `#pragma once` on line 1, then license, then blank.
+        {
+            echo "$first_line"
+            echo "// $COPYRIGHT"
+            echo "// $SPDX"
+            echo
+            tail -n +2 "$f"
+        } > "$tmp"
+    elif echo "$first_line" | grep -q "^#ifndef"; then
+        # Header form 2: insert license ABOVE the include guard.
+        {
+            echo "// $COPYRIGHT"
+            echo "// $SPDX"
+            echo
+            cat "$f"
+        } > "$tmp"
+    else
+        # Other (most likely a .cpp): just prepend.
+        {
+            echo "// $COPYRIGHT"
+            echo "// $SPDX"
+            echo
+            cat "$f"
+        } > "$tmp"
+    fi
+    mv "$tmp" "$f"
+}
 
 # Files to check: code/include + code/src + code/tests.  Skip code/deps.
 FILES_LIST="$(find code/include code/src code/tests \
@@ -39,6 +86,7 @@ FILES_LIST="$(find code/include code/src code/tests \
 
 n_total=0
 n_missing=0
+n_fixed=0
 missing_list=""
 while IFS= read -r f; do
     [ -z "$f" ] && continue
@@ -46,6 +94,10 @@ while IFS= read -r f; do
     # Check only the first 30 lines — SPDX must be near the top.
     if ! head -30 "$f" | grep -q "$SPDX"; then
         n_missing=$((n_missing + 1))
+        if [ "$FIX" -eq 1 ]; then
+            insert_header "$f"
+            n_fixed=$((n_fixed + 1))
+        fi
         missing_list="$missing_list  $f
 "
     fi
@@ -60,14 +112,20 @@ fi
 
 echo "Checked $n_total source files for SPDX header."
 
+if [ "$FIX" -eq 1 ]; then
+    if [ "$n_fixed" -gt 0 ]; then
+        echo "FIX mode: inserted '$SPDX' into $n_fixed file(s)."
+        echo "          Review with: git diff"
+        exit 0
+    fi
+fi
+
 if [ "$n_missing" -gt 0 ]; then
     echo
     echo "FAIL: $n_missing file(s) missing '$SPDX' in their first 30 lines:"
     printf '%s' "$missing_list"
     echo
-    echo "Recovery: add this two-line header at the top of each file:"
-    echo "  // Copyright (c) 2024-$(date +%Y) Tarik Moussa."
-    echo "  // $SPDX"
+    echo "Recovery:  bash scripts/quality/license-headers.sh --fix"
     exit 1
 fi