Fix three correctness gaps in the license-compliance-audit skill

[justinmclean]

Summary

Three defects in skills/license-compliance-audit/SKILL.md: a report cites a
file that only one code path writes, large files are silently miscounted, and
the SPDX matching accepts a token that is not valid SPDX.

Background

The skill has two scan paths, a local checkout and a github API scan, and the
reporting section assumes the local one. Of the three, the large-file case is
the one that produces wrong results a user would act on.

Where to look

• Line 215 writes /tmp/lca-missing-spdx.txt, but only in the local-checkout
  branch. Line 287 tells the reader to find the remaining files there, so in
  github scan mode the citation points at a file never created.
• The github SPDX scan section - gh api .../contents/<path> returns no content
  for blobs over about 1MB. Those decode to empty and are counted
  MISSING-SPDX-HEADER, a false positive. The Failure modes table has no row.
• Line 254 treats Apache-2.0 and Apache 2.0 as equivalent. The spaced form is
  not a valid SPDX identifier.

Acceptance criteria

• The report only cites /tmp/lca-missing-spdx.txt on the path that writes
  it, or both paths write it.
• The Failure modes table gains a row for blobs too large for the contents API.
• The SPDX matching no longer treats the spaced form as equivalent, or states
  why the leniency is deliberate.
• skill-and-tool-validate still passes.

Estimated effort

~3 hours for someone new to the codebase. The three are independent.