fix: cache licensed action (#422)

## Summary

Automate license cache refreshes during the Licensed CI check.

## Details

The Licensed workflow previously ran `licensed status` directly against
the committed `.licenses` cache. Dependabot dependency bumps could fail
when the cache was stale or missing records, even when the new
dependency licenses were allowed.

This updates the check job to run `licensed cache` before `licensed
status`, so CI refreshes dependency records in the ephemeral checkout
before enforcing the license policy.

## Expected behavior

The Licensed workflow should now only fail when Licensed detects an
invalid, missing, or disallowed license, not merely because committed
cache records are stale.