Replace `js-green-licenses` with a maintained alternative

## Context #4240 patches `js-green-licenses` (jsgl) to fix a regex bug and works around a broken CLI invocation that's been silently no-op'ing the license check for most workspace packages. That unblocks the alpha release PR (#4239), but it leaves us pinned to an archived dependency. ## Why replace it [`google/js-green-licenses`](https://github.com/google/js-green-licenses) is **archived**: - Last release: v4.0.0 (Jan 2023) - Repo went read-only; 27 open issues and 12+ open PRs sit unanswered - The exact regex bug we patched in #4240 has had an open upstream fix ([PR #230](https://github.com/google/js-green-licenses/pull/230)) since Feb 2024 with zero maintainer engagement We can't expect any future fixes, including for genuinely new SPDX licenses we'd want to allow. ## What to evaluate A few candidates to compare: - [`license-checker-rseidelsohn`](https://www.npmjs.com/package/license-checker-rseidelsohn) — actively-maintained fork of the classic `license-checker` - [`@inquirer/license`-style scripts wrapping `npm-license-checker`](https://www.npmjs.com/package/license-checker) - A small in-house script reading `package.json` license fields directly + an allowlist (likely the simplest given how little jsgl is actually doing for us) Whatever lands should: - Walk the whole monorepo (every `packages/*/package.json`), not just one - Skip workspace packages so unpublished alpha versions don't break the check - Have an allowlist mechanism for non-SPDX-but-known-good packages - Be fast enough for CI (jsgl currently takes ~1m of npm lookups) ## Cleanup when this lands - Remove `resources/patches/js-green-licenses+4.0.0.patch` - Drop `js-green-licenses` from `package.json` dependencies - Update `js-green-licenses.json` schema or replace it with the new tool's config