fix(inventory): emit the SPDX header from the generator - #399

Issue #396. The relicense (#389) stamped Apache-2.0 headers onto the two
inventory.gen.go files, but make generate runs the generator under every build
and test, and the generator did not emit a header — so any make invocation
rewrote both files headerless, and the next commit that staged them would have
silently undone the relicense on those files. Observed in practice minutes
after #389 merged, and twice more since: every local build left both files
modified with exactly the header lines deleted, repaired by hand each time.

writeInventory now emits the SPDX and copyright lines itself, matching the
repository convention exactly so star lint copyright accepts regenerated
output unchanged. Same defect class, same remedy as the defaultGolangciConfig
template #389 already fixed: a generator whose output must carry the header
emits it from the template rather than relying on a one-time sweep.

Proven by regeneration: make generate now produces output byte-identical to
the committed files — the strip-restore cycle is dead. The committed
inventory.gen.go files need no change in this commit.

Verified: make vet, make lint-all, full make test green — zero FAIL or panic
lines by count; gofmt clean.
Issue: #396