docs: bind complete reference sandbox source inventory

[abrichr]

What changed

Publishes the stable, machine-readable source and notice inventory for the
isolated OpenAdapt reference sandbox.

• Accounts for the pinned Ubuntu VM base and every image used by OpenEMR,
  Frappe Lending, and openIMIS.
• Separates actual image mappings from provider-derived artifacts such as the
  Frappe application image and retained openIMIS deployment configuration.
• Records exact upstream refs, commits, and licenses where known and explicitly
  states when an image-to-source build attestation is not asserted.
• Identifies the OpenAdapt-authored fixture/oracle and sandbox assembly inputs
  by exact hash.
• Deliberately omits the private Cloud release digest so the immutable notice
  URL and content hash can be baked into the provider release without a
  circular hash.

Why

The live reference sandbox must bind every served component to reviewable
source and notice evidence before provider spend or public activation. The
Cloud release will fetch this exact immutable file, verify its bytes, and
include the merged URL and hash in its release-counted license contract.

Validation

• Exact head: ab08e0eddfb5c3fe83b6bf9c36732a40a3c50a22
• Target manifest SHA-256:
  0e93454ba17112a1d694368bdd6def25e2c91585697808a2e583d7f4f63af63d
• Notice content SHA-256:
  cdb75a0c2ee67f13b2d9552e7aa58e09bc5a3693103c748c65eb3be25fe47d2a
• Cloud exact-byte notice validator passed
• Provider contract tests: 21/21
• Qualification parser tests: 2/2
• Independent image/artifact-key accounting and git diff --check passed

This PR changes documentation data only. It does not deploy, spend provider
resources, enable the public sandbox, or alter PyPI/package artifacts.