Binary license manifests lack CI enforcement

### What happened?

Nothing in CI catches drift between `LICENSE-binary` / `NOTICE-binary` and the actually-bundled dependencies. A contributor can add a dep in `build.sbt`, `frontend/package.json`, or `amber/requirements.txt` without the manifests being updated to match.

### How to reproduce?

1. Add a new JVM dependency in any `build.sbt`.
2. Run `sbt dist`.
3. The new jar appears in the dist's `lib/` but is not mentioned in `LICENSE-binary`; no CI job flags it.

### Version

1.1.0-incubating (Pre-release/Master)

### Commit Hash (Optional)

ef663648d

### Proposed fix

Add a CI workflow that, for each ecosystem (JVM jars, npm, Python), enumerates the actually-bundled deps at build time and diffs them against the bullets in `LICENSE-binary`. Fail on drift with ADDED / STALE classification.

### Was this authored or co-authored using generative AI tooling?

Generated-by: Claude Code (Claude Opus 4.7)

Start with LICENSE-binary and NOTICE-binary, then inspect build.sbt, frontend/package.json, and amber/requirements.txt alongside the existing sbt dist process. Determine how each ecosystem's actually bundled dependencies can be enumerated and compared with the manifest bullets. Done means CI reports ADDED and STALE entries and fails when the manifests drift.

Written by the indexing model from the issue text.