fix(ci): ignore the JSON-license false positive in smoke-local.sh too

Round 2's smoke fix added the archive member list 'cbm-integrations.json LICENSE
install.sh ...' to scripts/smoke-local.sh (mirroring package-release.sh), which
reintroduced the exact ScanCode false positive that commit 83df500 quieted for
package-release.sh: the '.json LICENSE' token adjacency reads as the SPDX 'JSON'
license. Same class, same fix — smoke-local.sh is a first-party MIT build
script listing its own archive members, added to the license policy's
ignored_paths with the shared justification.

Swept every ScanCode-scanned file (src/pkg/scripts, the gate's own file set) for
the adjacency: the only three carrying it — package-release.sh, smoke-local.sh,
and license-policy.json itself — are all now in ignored_paths, so this closes it
rather than trading one flagged file for another.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

scripts/license-policy.json

@@ -16,14 +16,15 @@
     "LicenseRef-scancode-public-domain",
     "LicenseRef-scancode-public-domain-disclaimer"
   ],
-  "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references; package-release.sh lists the archive members 'cbm-integrations.json LICENSE ...' adjacently (an order the Windows single-binary contract locks), and ScanCode reads the '.json LICENSE' token adjacency as a reference to the SPDX 'JSON' license — a first-party MIT build script, not vendored code.",
+  "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references; package-release.sh and smoke-local.sh list the archive members 'cbm-integrations.json LICENSE ...' adjacently (the order the Windows single-binary contract locks, mirrored by the smoke fixture), and ScanCode reads the '.json LICENSE' token adjacency as a reference to the SPDX 'JSON' license — first-party MIT build scripts, not vendored code.",
   "ignored_paths": [
     "tree/scripts/license-policy.json",
     "tree/scripts/license-gate-check.py",
     "tree/scripts/license-gate.sh",
     "tree/scripts/gen-third-party-notices.sh",
     "tree/src/discover/discover.c",
     "tree/scripts/audit-license-provenance.py",
-    "tree/scripts/package-release.sh"
+    "tree/scripts/package-release.sh",
+    "tree/scripts/smoke-local.sh"
   ]
 }