The committed bundle carries the copyright notices of the code inside it

## Summary

`dist/index.js` inlines six third-party packages but claims a single
copyright holder and retains none of their notices. Attribute the code
the bundle actually contains.

## Motivation

`REUSE.toml` annotates the bundle as:

```toml
[[annotations]]
path = ["dist", "dist/**"]
SPDX-FileCopyrightText = "2026 Alex Brandt "
SPDX-License-Identifier = "MIT"
```

esbuild inlines every import, so that one file also contains
`@actions/core`, `@actions/exec`, `@actions/io`, `@actions/http-client`,
`tunnel`, and `undici` — and, through undici's own vendored code, at least
`formdata-polyfill` and `ws`. Two of those survive in the output as
attribution comments:

```console
$ grep -nE 'MIT License' dist/index.js
19482: (*! formdata-polyfill. MIT License. Jimmy Wärting <...> *)
19485: (*! ws. MIT License. Einar Otto Stangvik *)
```

Everything else is stripped. Every package involved is MIT, so the
`SPDX-License-Identifier` is right; the copyright line is not. MIT is
explicit that this matters:

> The above copyright notice and this permission notice shall be included
> in all copies or substantial portions of the Software.

Bundling substantial portions of six MIT packages, dropping their notices,
and asserting sole copyright over the result is a compliance miss rather
than a cosmetic one. `reuse lint` passes because REUSE checks that every
file carries *an* annotation, not that the annotation is true.

esbuild's default `legalComments: 'eof'` preserves only comments already
marked `/*! */`, `@license`, or `@preserve` in the dependency's own
source. Most packages ship their licence as a `LICENSE` file instead,
which is why almost nothing survives. So this is not fixable by changing
that setting alone — something has to read the dependencies' licence
files.

## Scope

- Decide how the notices are carried. Options, cheapest first:
- Generate a licence file next to the bundle (`dist/licenses.txt`) from
the production dependency tree at build time, and annotate `dist/**`
in `REUSE.toml` to point at it rather than claiming sole copyright.
- Adopt [`licensed`](https://github.com/licensee/licensed), which is
what `actions/typescript-action` uses: a cached manifest of dependency
licences plus an allow-list, checked in CI.
- Reconsider `@vercel/ncc`, whose `--license` flag aggregates dependency
licences into the output directory as a built-in. #1 chose esbuild
partly on maintenance grounds; this is a capability that choice gave
up.
- Correct the `REUSE.toml` annotation so it no longer names one holder for
a file with several.
- Decide whether an allow-list gate is wanted, or only attribution. Every
current dependency is MIT, so a gate has nothing to catch today; it
earns its place the first time a transitive dependency is not.

## Acceptance criteria

- [ ] The notices of every package inlined into `dist/index.js` ship with
it.
- [ ] `REUSE.toml` no longer asserts a single copyright holder over the
bundle.
- [ ] Adding a dependency updates the attribution without a manual step,
or CI fails until it is updated.
- [ ] `reuse lint` and the existing checks still pass.

## Additional context

- Introduced in #1 and not caught there: `reuse lint` passing was taken as
evidence the licensing was correct, and it only ever proved the file was
annotated.
- Neither alunduil/woodland-generators nor
dungeon-studio/genshin.dungeon.studio covers this, because neither
commits a bundle of third-party code. The household REUSE convention
addresses files we author; it says nothing about vendored code inside
one of them.
- `actions/typescript-action` carries `.licensed.yml` and a `licensed.yml`
workflow for exactly this.