chore(ai): Add check-code-attribution skill (JAVA-499) (#5449)

chore(ai): Add check-code-attribution skill (JAVA-499)

Adds a check-code-attribution skill that validates license headers + THIRD_PARTY_NOTICES.md entries for code copied or adapted from third parties. Also verifies license compatiblity against Sentry's licensing policy.

Focus is limited to the branch diff. Reports any issues found via PR comments (when run on CI) or to the terminal (when run locally).

To run it in Claude Code:

 ```
 /check-code-attribution
 ```

Runs on CI automatically via [Warden](https://warden.sentry.dev/).

- Purely advisory / does not block merge.
- Generates PR comments with code suggestions for all discovered issues.
- Automatically manages removing stale comments as PRs are updated.

Current Warden configs:

  ┌─────────────────┬─────────────────────────────┬───────────────────────────────────────────────────┐
  │     Setting     │            Value            │                      Effect                       │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ model           │ anthropic/claude-sonnet-4-6 │ Model used for analysis                           │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ maxTurns        │ 30                          │ Max tool calls per chunk                          │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ skill           │ check-code-attribution      │ Per-file vendored code attribution check          │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ failOn          │ off                         │ Do not fail workflow if attribution issues found  │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ reportOn        │ medium                      │ Show findings at >= medium severity via PR comment│
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ requestChanges  │ false                       │ Never post REQUEST_CHANGES comments on PRs        │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ failCheck       │ false                       │ No red X on workflow in GitHub UI if it fails     │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ triggers        │ pull_request + local        │ Runs on PR open/sync and local warden invocations │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ reportOnSuccess │ false (default)             │ No comment when everything is clean               │
  └─────────────────┴─────────────────────────────┴───────────────────────────────────────────────────┘

Going forward, we can consider blocking PRs once we've had a chance to vet behavior in the wild.