[ScottishTapWater]

Summary

• Pilot OSS Review Toolkit (ORT) for NuGet licence compliance on pull requests and manual runs.
• Fail on unknown licences or licences outside the approved permissive list: MIT, Apache-2.0, 0BSD, BSD-1-Clause, BSD-2-Clause, BSD-3-Clause, BSL-1.0, ISC and Zlib. GPL-family licences are outside the list.
• Put findings in the Actions job summary and update a PR comment after a failed run. Keep the analysing workflow read-only; a separate workflow_run workflow posts comments, including for fork PRs.

Verification

• The hosted licence-compliance check passed on this PR after fixing ORT's writable project cache and home-directory needs on the runner.
• Local ORT 92.0.0 analysis found 43 NuGet packages across 15 projects and passed the policy, including a test with a user ID different from the image's default.
• Synthetic GPL-3.0-only and missing-licence cases failed; the four additional permissive SPDX identifiers passed.
• Exercised comment creation, PR matching, missing evaluation output and success handling with mocked GitHub API responses; parsed both workflows with act.
• Independent review found no blocking issue, including after the hosted-run fixes.

Pilot limit

GitHub only runs the workflow_run commenter when that workflow exists on the default branch. This first PR therefore cannot demonstrate the comment live; a subsequent PR can verify it after merge.