Map every published .NET runtime component to exact notice evidence

[KeyffMS]

What changed

• capture the exact MSBuild FilesToBundle inventory between PrepareForBundle and single-file generation;
• import exact official .NET license and ThirdPartyNotices.txt material from a hash-verified SDK archive;
• generate a separate component-coverage stage from restored packages and final publish files;
• retain exact NuGet SHA-512, .nuspec license metadata, package-relative asset paths and component SHA-256 values;
• map 447 embedded and 5 loose package components across three exact packages;
• identify two previously misclassified shipped assemblies from Microsoft.Windows.SDK.NET.Ref/10.0.19041.56 and record its package-specific license section;
• write schema-2 component evidence without retaining build-machine paths;
• independently validate every loose binary and notice mapping inside the final ZIP;
• reject unreviewed/non-shipped packages and any binary whose component mapping is missing;
• add a negative case that removes one real mapping while leaving its DLL in the package;
• correct dependency policy and redistribution/build/packaging documentation.

Root cause

The previous implementation proved exact SDK/runtime versions and official notice hashes, but only connected them to runtime-pack identities. It did not preserve a component-level inventory for the actual embedded and loose files. Publish-time evidence also showed that Microsoft.Windows.SDK.NET.Ref, previously described as build-reference-only, contributes Microsoft.Windows.SDK.NET.dll and WinRT.Runtime.dll to SightAdapt.exe.

Validation result

The reviewed artifact maps 452 components across:

• Microsoft.NETCore.App.Runtime.win-x64/8.0.29 — 165 components;
• Microsoft.WindowsDesktop.App.Runtime.win-x64/8.0.29 — 285 components;
• Microsoft.Windows.SDK.NET.Ref/10.0.19041.56 — 2 embedded components.

All five loose native DLLs are verified by SHA-256. The package-specific Windows SDK notice records exact SHA-512 and the .nuspec license URL https://aka.ms/WinSDKLicenseURL.

Scope

Release packaging, notice evidence and focused package validation only. Application behavior is unchanged.

Closes #83.