fix: gate go-licensing rules on real repo visibility

[bborbe]

Problem

check_license_file_required (scripts/rule-checks.sh) was a bare [ ! -f "$TARGET_DIR/LICENSE" ]. Its emitted message reads "Public Go projects must have a root LICENSE file", but nothing in the function ever determined whether the repo was public — so docs/go-licensing-guide.md's private-repo exemption was documented and never implemented. check_readme_license_section had the same gap.

Two further defects in the same rule:

• The guide's detection heuristic ("hosted on github.com → public") predates the Octopus migration, which moved 73 private Seibert-Data repos onto github.com. Host stopped implying visibility.
• The rule was not actually Go-scoped despite its own comment saying "applies to any Go project" — it fired on repos containing no Go at all.

Measured impact: 4 of 73 non-archived Seibert-Data repos have a LICENSE. This MUST-tier rule was firing on essentially every repo in the org, on every PR. Seibert-Data/agent#7 had to be admin-merged to get past it.

Change

• repo_visibility() — reads gh repo view --json isPrivate, memoised (one call per run at most) and consulted only when a finding would otherwise fire, so the common path stays cheap.
• repo_is_public() — true only when the repo is known public. Fails open on unknown (no gh, no remote, offline, not a repo): a MUST-tier false positive blocks every PR in an org, while a missed finding on a public repo surfaces at the next review.
• license-file-required now also requires go.mod, matching its documented Go scope.
• Guide rewritten to use the isPrivate flag, with an explicit "do NOT infer visibility from the host" note and the fail-open behaviour documented.

Verification

make precommit passes (30 rule-coverage tests, 225 bench tests). Six behavioural cases run against real clones:

Case	Expected	Result
No remote / not a repo	fail open, silent	✅ no findings
Private + go.mod, no LICENSE	silent	✅ no findings
Public + go.mod, no LICENSE	still fires	✅ license-file-required
Private, README without ## License	silent	✅ no findings
Public, README without ## License	still fires	✅ both rules
No go.mod	silent (Go-scoped)	✅ no findings

The regression cases matter as much as the fix: this must not silently disable licensing enforcement on public repos, and it doesn't.

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "Clean fix. The PR correctly gates both go-licensing MUST rules on real repo visibility (via `gh repo view --json isPrivate`) instead of the broken host-based heuristic, bringing the enforcement in line with what the rule's own `applies_when` always stated. Fail-open is documented and intentional. The go.mod scoping on `license-file-required` aligns with the rule's docs. Conventional-prefix changelog entries are correct. Shellcheck passed with zero findings.",
  "comments": [],
  "concerns_addressed": [
    "correctness: fail-open behavior on 'unknown' visibility is documented intentional design — MUST-tier false positives block all PRs, missed findings on public repos surface at next review",
    "correctness: license-file-required now requires go.mod (Go-scoped per its own docs) — narrowing scope away from non-Go repos with LICENSE files is the correct behavior",
    "correctness: REPO_VISIBILITY_CACHE is a single-run script with correct short-circuit on cache hit — no stale-cache issue in practice"
  ]
}