What do we do if the SPDX tag is the same as the existing license
tag (eg ISC) though? Do we just add a dummy change/commit entry that
mentions SPDX to confirm we've reviewed it?

Don't bother. Eventually, we'll re-process all spec files and identify
what to do next anyway.

Actually... if you add there the dummy changelog entry, it makes my work easier.

Miroslav