Audit release licenses and provenance (#104)

NOTICE.md

@@ -0,0 +1,53 @@
+# MetaCrate notices and attribution
+
+MetaCrate's Rust implementation is licensed under the BSD 3-Clause License in
+[`LICENSE.md`](LICENSE.md). It is a clean native Rust rewrite based on the
+public API and observable behavior of LibreMetaverse at commit
+`2aa70bb68513b39795da5d13c88f31b86e85a3ba`. The upstream BSD notice is
+retained in `LICENSE.md` for openmetaverse.co (2006–2016) and Sjofn LLC
+(2017–2025). The exact pinned upstream text is included in
+[`licenses/LibreMetaverse-BSD-3-Clause.txt`](licenses/LibreMetaverse-BSD-3-Clause.txt).
+
+## Linden viewer data
+
+The following exact, unmodified files are Linden viewer data redistributed by
+LibreMetaverse under Creative Commons Attribution-ShareAlike 3.0 Unported:
+
+- `codegen/inputs/attentions.xml`
+- `codegen/inputs/attentionsN.xml`
+- `codegen/inputs/avatar_lad.xml`
+- `codegen/inputs/avatar_skeleton.xml`
+- `codegen/inputs/genepool.xml`
+- `codegen/inputs/grass.xml`
+- `codegen/inputs/trees.xml`
+
+The original author/attribution party is Linden Lab. MetaCrate copied these
+files without modification from the pinned LibreMetaverse `LibreMetaverse/linden/`
+tree. Their generated Rust data tables identify the input, exact SHA-256, and
+CC-BY-SA-3.0 license. The license URI and pinned legal-code hash are retained in
+[`licenses/CC-BY-SA-3.0-NOTICE.md`](licenses/CC-BY-SA-3.0-NOTICE.md).
+
+No Linden textures, meshes, animations, gestures, clothing, body parts, or
+viewer binaries are included. The protocol `message_template.msg` is separately
+tracked as BSD-3-Clause material from LibreMetaverse's `data/` tree and is not
+classified as a Linden CC asset by the pinned upstream repository.
+
+## Generated and translated material
+
+Generated Rust files retain machine-readable source hashes and licenses in
+their headers. The LSL parser grammar snapshot, compatibility fixtures,
+translated tests, API mappings, and program mappings are covered by the
+MetaCrate and upstream BSD notices. Their exact provenance is checked by the
+Rust release-provenance audit and its locked manifests.
+
+## Dependencies and native components
+
+[`release/THIRD-PARTY-NOTICES.md`](release/THIRD-PARTY-NOTICES.md) contains the
+complete locked Rust package inventory and the license/notice files shipped by
+each package. [`release/NATIVE-LICENSES.md`](release/NATIVE-LICENSES.md) records
+native components, whether MetaCrate bundles them, and the notice obligations
+for binary distributors. Both are generated from
+[`ci/provenance-policy.json`](ci/provenance-policy.json) and `Cargo.lock`.
+
+A source or binary distribution is complete only when it includes the notice
+files required by [`release/DISTRIBUTION-MANIFEST.json`](release/DISTRIBUTION-MANIFEST.json).