Ship third-party license texts for the bundled JS assets

Problem

pkg-py/src/shinychat/www/shinychat.js (1.1 MB) is a prebuilt bundle that vendors third-party MIT-licensed code. From the esbuild legal-comments block at the end of the file:

esbuild names each package, which is good attribution, but the React headers say:

This source code is licensed under the MIT license found in the LICENSE file in the root directory of this source tree.

That's a pointer to a file we don't ship. The only license text in the sdist is LICENSE (shinychat's own MIT, Posit PBC). MIT requires the full license text and copyright notice to accompany redistribution, so the bundle as shipped is attribution without the text it points to.

To reproduce:

$ tar xzf shinychat-0.6.0.tar.gz
$ grep -A3 'Bundled license information' shinychat-0.6.0/pkg-py/src/shinychat/www/shinychat.js

Why it's surfacing now

The conda-forge staged-recipes PR checklist (pull_request_template.md#L49) says:

Package does not vendor other packages. (If a package uses the source of another package, they should be separate packages or the licenses of all packages need to be packaged).

and the conda-forge docs section Licenses of included dependencies says each vendored dependency needs its license file included in the recipe. Their tooling recommendations (cargo-bundle-licenses, go-licenses) are Rust/Go-specific; there's no equivalent guidance for bundled JS in a Python package, and enforcement is reviewer discretion. We are proceeding with conda-forge/staged-recipes#34338 as-is rather than blocking on this.

Proposed fix

Emit a third-party license file during the JS build and ship it in both the sdist and wheel:

1. Collect license texts for the bundled deps at build time — e.g. a license-checker-rspack / generate-license-file step in js/, writing THIRDPARTY.txt.
2. Include it in the Python package alongside LICENSE (and in the R package if pkg-r ships the same bundle).
3. Verify it lands in the sdist: tar tzf dist/shinychat-*.tar.gz | grep -i thirdparty.

All bundled code is MIT, same as shinychat, so this is a compliance-hygiene fix rather than a licensing conflict.

Release note / follow-through

Once a release ships THIRDPARTY.txt, update the conda-forge feedstock to reference it, so the vendored licenses are packaged in the conda artifact too:

about:
  license_file:
    - LICENSE
    - THIRDPARTY.txt

The autotick bot bumps version and sha256 only — it won't add the new license_file entry, so this needs a manual edit to the bot's PR on shinychat-feedstock (or to recipes/shinychat/recipe.yaml in staged-recipes if that PR is still open at the time).

Inspect the JS build under js/ and the bundled asset at pkg-py/src/shinychat/www/shinychat.js, then reproduce the sdist check with the commands in the issue. Determine how the generated license file is included in the sdist, wheel, and any R package shipping the same bundle. Done means THIRDPARTY.txt contains the bundled MIT license texts and the conda-forge recipe references both license files.