Replace CDDL/MPL deps to reach pure MIT/BSD/Apache license footprint

Background

Pre-publish license audit (May 2026) found two runtime Rust dependencies with non-permissive (weak copyleft) licenses statically linked into the `basilisk` and `basilisk-profiler-helper` binaries shipped in the VSIX:

Both are currently mitigated by shipping the `NOTICES` file inside the VSIX with full license text + a "modifications: NONE" statement (legally compliant). But this is paperwork we'd rather not maintain.

Goal

Drop both deps so Basilisk's runtime license footprint is pure permissive (MIT / BSD / Apache-2.0 / ISC / Unicode / Zlib). No CDDL, no MPL, no weak copyleft of any kind.

Tasks

• Replace `colored` with `nu-ansi-term` (already in the dep tree, MIT) or `owo-colors` (MIT). Trivial drop-in — both expose similar `.color()`/`.bold()` builders. Audit every `use colored` site in `crates/basilisk-cli/` and swap.
• Replace or drop `inferno`. Options:
  • Drop the flamegraph SVG generation feature entirely (write raw stack traces only, let users feed them into `flamegraph.pl` themselves).
  • Find a permissive flamegraph crate (none currently exist on crates.io that are well-maintained — verify).
  • Vendor just the SVG-emission code we use under a clean-room rewrite.
• Verify `py-spy`'s transitive `inferno` dep gets pruned (it may use a feature flag we can disable).
• Re-run `cargo tree | grep -E 'CDDL|MPL|GPL|LGPL'` — must come back empty.
• Remove the `inferno` and `colored` sections from `NOTICES` once they're gone.
• Update the third-party license audit doc.

Why this matters

• Cleaner license story for downstream packagers (homebrew, distros, vendoring into proprietary projects).
• One less thing to remember when adding the eventual full `THIRD_PARTY_LICENSES.txt` generator (`cargo-about`).
• MPL/CDDL aren't VS Code Marketplace blockers but they do require source-availability statements, which gets tedious at scale.

Non-goals

• This is hygiene, not a blocker. Publishing today is legally fine with the NOTICES file in place.

Start with the dependency declarations in Cargo.toml and crates/basilisk-lsp/Cargo.toml, then audit every use of colored in crates/basilisk-cli/. Check the NOTICES file and the third-party license audit document, and inspect py-spy's inferno feature path. Done means the dependencies and notices are removed, the audit is updated, and cargo tree | grep -E 'CDDL|MPL|GPL|LGPL' returns empty.