docs: publish reference sandbox source notices

[abrichr]

Summary

Publish one machine-readable source-and-notices manifest for the isolated OpenAdapt reference sandbox.

It identifies the exact OpenEMR, Frappe Lending, ERPNext, Frappe Docker, and openIMIS upstream repositories, immutable commits, release tags, container-image digests, licenses, required notice links, and modification status. It also states the independent OpenAdapt Cloud wrapper/source-availability boundary without exposing private implementation code.

Boundary

• Docs only; no package or runtime code changes.
• No copied GPL/AGPL source.
• Upstream modifications are declared as none.
• The manifest is bound to Cloud sandbox release digest 44b023311abd1808247c361e32f8901a42b73516268c6f0f21797b97cf61c564 and target manifest digest 032e05a5364beddce58c4752d9889fa7a2d2c41f0555285d4e416bae75d96c88.

Validation

• JSON parses successfully.
• All target IDs and image digests match the reviewed Cloud release manifest.
• Every exact upstream commit resolves in its public source repository.
• git diff --check passes.

No provider resources were created and the public sandbox remains disabled.