fix: generate and publish THIRD-PARTY-NOTICES for bundled dependencies

[MaximeGaudin]

Summary

• The release binaries link 441 third-party crates under MIT/Apache/BSD/MPL-family licenses, but no NOTICE/THIRD-PARTY-NOTICES file existed anywhere, so binary distributions carried no license attribution.
• Added scripts/generate-third-party-notices.mjs, which reads cargo metadata and generates THIRD-PARTY-NOTICES.md: every dependency with its version and SPDX expression, the distinct license texts deduplicated into an appendix (read from the local cargo registry cache), and a fallback section with repository links for the 37 crates that ship no license file in the published package. The generated file is committed (441 crates, 99 distinct texts).
• The release workflow now copies THIRD-PARTY-NOTICES.md into the artifacts, so it is published as a downloadable release asset alongside the binaries. It is published as a separate asset rather than inside the binary tarballs on purpose: the tarball layout is consumed as-is by the documented install command (sudo tar xz -C /usr/local/bin), the Homebrew formula, and the binstall metadata, and adding a second file would break all three.

Fixes #212

Test plan

• node scripts/generate-third-party-notices.mjs runs clean and is idempotent; the todo-marker check passes on the script.
• release.yml parses as valid YAML (release workflow is workflow_dispatch-only, so the copy step is not exercised by this PR's CI).
• CI green on the PR