Pin alpine-keys license provenance

[jacklv-coder]

Summary

• pin the immutable upstream alpine-keys GPL-to-MIT license-decision patch with byte count and SHA-256
• bind the new payload into the external review tree and update reviewed counts from 77 to 78
• strengthen license-declaration provenance while keeping license-text coverage reference-only and package-level MIT grant/copyright, legal review, and redistribution gates open
• regenerate compliance evidence and update bilingual documentation and drift tests

Validation

• ./Scripts/test.sh (139 tests passed; 1 environment-gated skip)
• all RootFS Ruby script tests
• ./Scripts/check-docs.sh
• RootFS compliance generation --check
• external 78-payload bundle materialize, verify, and reviewed-tree verification
• git diff --check
• Codex CR on initial diff, exact committed diff, and review fix: no remaining P1/P2 findings

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7a8bb9a74f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jacklv-coder]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: e8a4fe6471

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".