fix(packaging): ship bundled dependency notices and inventory

CONTRIBUTING.md

@@ -61,6 +61,27 @@ without installing this repository. `pnpm check:dist` compares build bytes with
 the checked-in bundle. Never hand-edit generated files. Update the source,
 rebuild, and review both source and distribution changes.
 
+The build also generates `dist/THIRD-PARTY-NOTICES.txt` and
+`dist/bundled-dependencies.json` from inputs with positive byte contributions to
+esbuild's executable output, excluding completely tree-shaken modules, alongside
+the existing inline notices in `dist/index.cjs.LEGAL.txt`. Commit all generated
+outputs; `pnpm check:dist` verifies them together. Full license sections in
+package READMEs are retained when standalone files are absent. The version-bound
+supplement for `@nodable/entities` comes from the license at its npm-published
+`gitHead`; keep that provenance with any update.
+Attribution-only `NOTICE` and `COPYRIGHT` files are retained separately; they
+do not suppress license fallbacks or resolve missing license terms.
+The version-bound protobuf runtime source headers retain the Google and
+protobuf.js BSD terms alongside the package's Apache license, rather than
+treating one license file as evidence for every declared component.
+
+Entries marked `missing-license-text` are unresolved public-release blockers,
+not approved exceptions. A passing build or packaging test does not clear them.
+Obtain authoritative terms and release-owner disposition; do not infer a
+license from a dependency's parent, another distributor, or a package name.
+The packaging regression records the current three gaps so dependency changes
+require an explicit reassessment.
+
 Use strict TypeScript, argument-array process invocation, and exact dependencies.
 Use `actions/checkout@v7`; other third-party Actions remain SHA-pinned.
 Do not log raw evaluator/process output or

README.md

@@ -390,6 +390,14 @@ provenance, not a claim that the graph was reviewed with the Action.
 The development dependency remains pinned to Vally 0.19.0 for deterministic,
 model-free CLI contract tests. It is a test fixture, not a runtime allowlist.
 
+Bundled dependencies are listed in
+[`dist/bundled-dependencies.json`](dist/bundled-dependencies.json), with available
+full terms in [`dist/THIRD-PARTY-NOTICES.txt`](dist/THIRD-PARTY-NOTICES.txt) and
+retained inline notices in [`dist/index.cjs.LEGAL.txt`](dist/index.cjs.LEGAL.txt).
+Entries marked `missing-license-text` still need authoritative terms and
+release-owner clearance before public distribution; packaging checks do not
+grant that clearance.
+
 Use Node 24 and the pinned pnpm version. Run `pnpm check`, rebuild and commit
 `dist/index.cjs`, and follow [CONTRIBUTING.md](CONTRIBUTING.md). Security reports
 belong through [SECURITY.md](SECURITY.md), not public PR comments.