Two checks red on main for reasons unrelated to any PR: lint-workflows (SPDX must be line 1) and estate-audit (sorry-prose false positives, e2e TODOs) #105

Both are red on main (PR #101's head: lint-workflows https://github.com/hyperpolymath/trope-checker/actions/runs/40391430680, estate-audit https://github.com/hyperpolymath/trope-checker/actions/runs/40391430520; latest main push: https://github.com/hyperpolymath/trope-checker/actions/runs/40392663190) and on PR #102 identically. Recorded here so #102 does not widen to fix them.

1. lint-workflows (workflow-linter.yml) — ERROR: … missing SPDX header for every file under .github/workflows/, "Add '# SPDX-License-Identifier: MPL-2.0' as first line". The files have the header, on line 2; line 1 is # This workflow is managed by gh actions-lock. The linter requires line 1. Either the linter accepts the header within the first N lines, or actions-lock emits its banner after the SPDX line.

2. estate-audit (main-estate-audit.yml, cicd-suite check.sh) — two things:

• "Untracked debt markers": tests/e2e.sh:72,81,88 carry template # TODO: lines (mint scaffold, never instantiated). Resolve or link as MARKER(#issue).
• "Undeclared proof circumventions": the scanner greps sorry and matches the prose /-! ## Axiom audit (sorry-free check) -/ headers in all eight Lean files and the "(sorry-free; …)" sentences in doc comments. The repo's own proof-scan-dangerous recipe is comment-aware for exactly this reason; the estate scanner is not. Options: make the suite comment-aware, or list the eight modules in .cicd-hygiene-allow with the trusted-base count as the error text suggests.