[Legal/.NET] Generate exact-version THIRD-PARTY-NOTICES for self-contained builds

[KeyffMS]

Completed decision

SightAdapt now generates exact-version Microsoft/.NET notice material and component-level evidence for the actual self-contained single-file publication. Notice generation is not based on a permanent generic copy.

Implemented state

• the exact .NET SDK and runtime packs are pinned and recorded;
• the official matching SDK ZIP is downloaded and verified by SHA-512;
• exact LICENSE.txt and ThirdPartyNotices.txt content is imported without substantive modification;
• MSBuild PrepareForBundle / FilesToBundle captures the exact inputs embedded in SightAdapt.exe;
• every embedded package component is mapped to an exact package, package-relative path and SHA-256;
• every loose runtime binary is matched by filename and SHA-256 to an exact restored package asset;
• exact NuGet SHA-512 and .nuspec license metadata are retained for every package contributing published components;
• package-specific notice sections are generated when a component is not covered by the official .NET release notice bundle;
• final metadata contains no absolute build-machine paths;
• general ZIP validation and focused component-coverage validation run independently;
• CI rejects incomplete, stale and deliberately unmapped packages.

Verified component inventory

The reviewed 0.5.0.50-alpha artifact contains 452 mapped package components:

Exact package	Components	Disposition
Microsoft.NETCore.App.Runtime.win-x64/8.0.29	165	embedded
Microsoft.WindowsDesktop.App.Runtime.win-x64/8.0.29	285	280 embedded, 5 loose
Microsoft.Windows.SDK.NET.Ref/10.0.19041.56	2	embedded

The Windows SDK package contributes Microsoft.Windows.SDK.NET.dll and WinRT.Runtime.dll. It is therefore classified as shipped-embedded, not build-reference-only. Its exact package SHA-512 and .nuspec license URL are preserved in the package notice evidence.

Acceptance criteria

• CI records the exact .NET SDK version and runtime-pack versions used for publication.
• Notice sources are official Microsoft/.NET sources tied to the exact release train.
• Source URLs, repository revisions where available, package SHA-512 and imported-file SHA-256 values are recorded.
• Generated evidence covers every embedded runtime/package component and every loose native binary in the self-contained output.
• Updating SDK, runtime pack, package inventory or publish settings requires regeneration and review.
• CI fails when a package component cannot be mapped to reviewed notice evidence.
• Generated files are present and human-readable in the final archive.
• Documentation explains generation, component mapping, final validation and maintenance triggers.

Implementation

PR #140, merged as 1e49e3dfa53f4888d50b6db224f8aa6018dd9ed4.

GitHub Actions run 30538840057 passed DCO, 210 tests, exact notice import, 452 component mappings, SBOM/license checks, three negative package tests, final ZIP validation and artifact upload.