docs: add licensing check guidance to CLAUDE.md and sync license lists

[jasonhernandez]

Summary

• Add a "Licensing checks" section to CLAUDE.md explaining the dual-file license policy (deny.toml + about.toml), how to handle new licenses, duplicate versions, and banned crates
• Sync license allow lists: add Unicode-DFS-2016 to deny.toml (was already in about.toml but missing from deny.toml — pre-existing drift on main)

Context

The deny.toml and about.toml files must be manually kept in sync (noted in comments in both files). They had drifted — about.toml had Unicode-DFS-2016 but deny.toml didn't. This caused no CI failure because cargo deny and cargo about check different things, but it's a latent inconsistency.

Adding CLAUDE.md guidance ensures AI-assisted dependency changes will check both files.

Test plan

• cargo deny check licenses passes
• License lists in both files verified to match

---

🤖 Generated with Claude Code

[github-actions]

Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone.

PR title guidelines

• Use imperative mood: "Fix X" not "Fixed X" or "Fixes X"
• Be specific: "Fix panic in catalog sync when controller restarts" not "Fix bug" or "Update catalog code"
• Prefix with area if helpful: compute: , storage: , adapter: , sql:

Pre-merge checklist

• The PR title is descriptive and will make sense in the git log.
• This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
• If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.
• This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
• If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
• If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).