fix(release): close final G3 source inventory gaps

[M4n5ter]

English

Summary

• Record the contributor-confirmed PawWork browser transfer boundary: Maka import commit fab537af179232cc88dc39314038000f70d15d05, the two fixed PawWork revisions, and the exact 23-file introduction surface.
• Guard that record in the ASF source legal-inventory test so the revisions, contribution status, and file boundary cannot silently drift.
• Clarify that the MingCute Apache-2.0 text resolves to the repository-root LICENSE in the source distribution and is copied to licenses/renderer/MINGCUTE_APACHE_LICENSE.txt only in desktop packages.

This closes the two concrete inventory gaps found while auditing the unsigned G3 source candidate. It does not change runtime behavior.

Refs #3270

Verification

• Generated apache-maka-0.2.0-incubating-src.tar.gz from exact commit f261fea8d93008ef1545e4e38e6b67ad51105c16 (2,884 files; SHA-512 15cea6ac2d42a35d26eefe45c40ae06885b5418c76f20f8bf9a4d2159f9a9b70ee3149da25750f0a96e1a7b256626d9d1a67fa2eeb8376c9338c6535f4a4c225).
• Extracted the exact archive and ran the source header audit: 2,751 covered files + 133 reviewed exclusions, all passing.
• Extracted-candidate checks passed with the repository-pinned npm@11.19.0: all three dependency notice inventories, check:asf-source (67/67), format, lint, full build, and all workspace typechecks.
• git diff --check passed.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex investigated the source-candidate gaps, implemented the provenance record and guards, and ran the verification above. The commit carries a Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

• 记录经贡献者确认的 PawWork 浏览器移植边界：Maka 引入提交 fab537af179232cc88dc39314038000f70d15d05、两个固定 PawWork revision，以及精确的 23 文件引入范围。
• 在 ASF 源码法律清单测试中守住这条记录，避免 revision、贡献状态或文件边界静默漂移。
• 明确 MingCute 的 Apache-2.0 全文在源码发行包中对应仓库根 LICENSE，只有桌面安装包才将它复制到 licenses/renderer/MINGCUTE_APACHE_LICENSE.txt。

这关闭了 G3 未签名源码候选人工审计发现的两个具体清单缺口，不改变运行时行为。

关联 #3270

验证

• 从 exact commit f261fea8d93008ef1545e4e38e6b67ad51105c16 生成 apache-maka-0.2.0-incubating-src.tar.gz（2,884 个文件；SHA-512 15cea6ac2d42a35d26eefe45c40ae06885b5418c76f20f8bf9a4d2159f9a9b70ee3149da25750f0a96e1a7b256626d9d1a67fa2eeb8376c9338c6535f4a4c225）。
• 解压真实归档并运行源码 header 审计：2,751 个 covered 文件 + 133 个已审查 exclusion，全部通过。
• 在解压后的候选中使用仓库固定的 npm@11.19.0 通过：三套依赖 notice 清单、check:asf-source（67/67）、format、lint、完整 build、全部 workspace typecheck。
• git diff --check 通过。

AI 使用

• 没有生成式工具做出实质贡献
• 生成式工具做出了实质贡献

工具与范围：OpenAI Codex 调查源码候选缺口、实现来源记录与守卫，并执行上述验证。提交带有 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，并会在缺少修复时失败
• lint、format、typecheck 与受影响测试均在本地通过

本 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[Astro-Han]

Approving at f261fea8d93008ef1545e4e38e6b67ad51105c16. Two independent lines reviewed this from different angles, and I am withdrawing the one finding we raised.

Provenance closes. The 23-path Maka boundary matches fab537af179232cc88dc39314038000f70d15d05 exactly — 23/23, nothing missing, nothing extra. The strongest apparent third batch, PawWork 168da7a0, was found and then retracted on inspection: it is an ancestor of both pinned snapshots, so its transferred controller/logic/options bytes are already inside aff7ce20 and e3595b70. Browser-relevant PawWork history through Maka's introduction date shows no later implementation batch carried over.

The OpenCode/NOTICE exclusion is supported rather than assumed. PawWork's OpenCode import predates the browser directories and lacks their distinctive symbols; the mapped browser files blame entirely to commits whose author email matches Maka fab537af. @jackwener/opencli is an ordinary Apache-2.0 dependency already covered by the packaged npm notices, and the full OpenCode MIT notice remains in the root LICENSE for the genuine non-browser adaptations.

The candidate was generated and unpacked, not merely reasoned about. SHA-512 15cea6ac…a4c225; 2,884 regular files and 156 directories with zero links, zero special entries, and zero paths outside the root; checksum verified; the extracted header audit accounted for every file (2,751 covered plus 133 reviewed exclusions); check:asf-source ran 67/67 and source-legal-inventory.test.mjs passed 5/5.

The MingCute change is a real fix. licenses/renderer/MINGCUTE_APACHE_LICENSE.txt does not exist in the source tree, so the previous pointer dangled in the source layout. electron-builder.config.mjs:160-162 copies the repository-root LICENSE to that path, and the new wording resolves correctly in both layouts. The accompanying test binds to those real artifacts rather than restating prose.

One finding withdrawn. I had raised that the new PawWork test hardcodes the 23 paths and compares them to the document, so a matching edit on both sides keeps it green — which I reproduced. On reflection that does not describe a defect here. It is the ordinary property of any expected-fixture test, and the decisive point is that source-legal-inventory.test.mjs has to run from the unpacked source candidate's own bytes, where no .git object store exists; deriving the list from the commit would require materializing a third generated manifest inside the candidate. The test's actual job is to catch one-sided drift in the document, which it does. A history audit that runs only in a repository checkout would be a reasonable follow-up, but it is not a condition for this change.

---

ran: independent verification of the 23-path boundary against fab537af; PawWork history search for additional batches; unsigned source candidate generation, unpacking and header audit; source-legal-inventory.test.mjs 5/5 plus mutation probes; confirmation that the exact-head test check is terminal success.
did-not-run: signed release artifacts.