Add model asset compliance inventory and release gates

[brxs]

Implements the inventory and release-control portion of #108 without making legal conclusions.

What changed

• adds a machine-readable inventory for 12 application, runtime, model, processor, and LoRA assets; exact revisions are recorded where the evidence supports them, and unresolved conversion-source revisions are explicit release gates
• records code licenses separately from model/weight terms, acquisition mode, immutable-reference status, redistribution state, access requirements, and owner-review gates
• adds a dependency-free validator and mutation tests
• adds human-readable third-party model notices
• adds a release checklist covering notices, immutable downloads, acknowledgements, credentials, LoRA provenance, and package parity

Findings intentionally left as release gates

• LSDJ has no project LICENSE or NOTICE
• the PyTorch MRT2 cards' Apache declaration conflicts with the stated CC-BY-4.0 provenance of re-keyed Google weights
• current Google MRT2, Stable Audio 3 optimized, and LoRA downloads use mutable references
• the documented Motif Maqam LoRA has no identified redistribution grant
• the reviewed optimized-model evidence does not identify the exact T5Gemma or Stable Audio 3 Medium source revisions used to produce derivative artifacts
• Stability Community/Gemma use, derivative-distribution, attribution, and acknowledgement paths need owner confirmation

Verification

• python3 compliance/validate_inventory.py
• python3 -m unittest compliance.test_inventory (11 tests)
• Ruff lint and format checks
• clean diff checks

This pull request supplies provenance evidence and enforceable release gates; it is not legal advice and does not approve any unresolved use or redistribution path.

[brxs]

Superseded by and fully consolidated into #131. The combined branch includes this lane's substantive changes, subsequent integration fixes, and exact-head cross-platform validation. Please continue review in #131.