Third-party notices

The repository maintains a generated inventory of the production dependency graph and the corresponding license texts in THIRD_PARTY_NOTICES.md.

That canonical notice file is included in each packaged VSIX. The release gate verifies that it matches the exact locked production dependency graph.