fix(build): pin the freezer, and register what Tcl 9 brought into the bundle

[donislawdev]

What broke

A freshly built executable died on every launch, before any project code ran:

File "pyi_rth__tkinter.py", line 28, in _pyi_rthook
FileNotFoundError: Tcl data directory "...\_internal\_tcl_data" not found.

One cause, two symptoms. Python 3.14 on Windows ships Tcl/Tk 9.0, and Tcl 9 keeps its library
scripts in a zip archive embedded in tcl90.dll instead of a directory on disk.

1. PyInstaller 6.21.0 reads that path as a filesystem directory, warns
   TclTkInfo: Tcl library/data directory '//zipfs:/lib/tcl/tcl_library' does not exist! and
   collects zero Tcl/Tk data files, so _internal/_tcl_data is never created - while its own
   run-time hook requires it. PyInstaller 6.22.0 fixed both halves upstream: support for
   Tcl/Tk 9 builds with embedded data archives, and the missing-data-directory error moved from
   run time to build time. Verified in the installed sources, not just the changelog: the new
   run-time hook sets TCL_LIBRARY only if os.path.isdir(...) and never raises, while
   hook-_tkinter.py raises SystemExit on tcltk_info.tcl_data_missing.
2. Tcl 9 links libtommath, so libtommath.dll joined the bundle. The bundle-scan guard
   correctly refused it, which is why the weekly cron on master is currently red.

Neither symptom came from a commit. Both workflows installed a bare pyinstaller, so the
version that built an artefact was whatever the index served that day: CI resolved 6.22.1 and a
developer machine had 6.21.0. The same commit produced a working executable in one place and a
crashing one in the other, and nothing recorded which was which. Backlog item B-12 predicted this
in writing.

What this changes

• requirements-build.txt pins pyinstaller==6.22.1, and both workflows install it with
  -r. The interpreter already had a parity guard; the freezer had none, which is how the two
  environments drifted apart unnoticed.
• New guard test_both_workflows_install_the_same_pinned_builder: the pin must use ==, both
  workflows must install from the file, and a bare pyinstaller on any pip install line is
  rejected. Two entries added to the mutation registry, both confirmed red before being written
  down.
• libtommath registered across the whole licensing surface - the component registry,
  THIRD-PARTY-NOTICES.md, a verbatim licence text in licenses/, and the bundle-scan pattern.
  Its licence is the Unlicense, a public-domain dedication, so GPLv3-compatible. Unlicense was
  added to the curated SPDX allowlist after checking it against the official SPDX list.
• Two false comments corrected. The _TCL_CRUFT note in the spec claimed the filter drops
  "~750 files"; on Tcl 9 it drops nothing, and the comment now says which build is which and marks
  the Tcl 8.6 saving as not re-measured. The weekly-cron rationale in ci.yml still described
  pyinstaller as unpinned.

Verification

• Full suite: 1122 passed, plus the GUI smoke script.
• The rebuilt executable was launched, which is what nothing here had been doing: --version
  and a simulated session both exit 0, a bad configuration exits 3, and the graphical interface
  opens a real window (checked by window title, because a live process with no window looks
  identical from outside).
• Real bundle scan, not a synthetic one: syft names 56 artefacts and agrees with the version CI
  runs, libtommath included. Paired control both ways - with the registry entry the audit exits
  0, with the entry deleted it exits 1 and names the component. The first attempt at that control
  silently tested nothing, because the restore command had nothing to restore; it was redone.

Incidental measurement: the Tcl 9 bundle is 105 files against roughly 266 on Tcl 8.6.

Not done, on purpose

• Automatically opening an issue when the weekly cron fails was considered and declined. The cron
  caught this hours before a hand-built executable did, so ci.yml now says plainly that a red
  cron is read by hand, and with which command.
• The Tcl 8.6 size saving was not re-measured - the comment says so rather than restating an old
  number as fact.
• The graphical About window was not checked with a screenshot; only the command-line licence
  report was.