EPBDS-16211 F1 step 4: third-party notices, ahead of vendoring the CSS

[AlexSamBY]

The prerequisite for step 4's second half, and it has to land before the dependency goes: while the CSS is imported, each Semantic module carries its own /*! banner into the build and those banners survive minification. Once the CSS is copied into this repository, nothing keeps them current automatically.

THIRD-PARTY-NOTICES.md at the root — not in static/all.css, which is a build artifact and is gitignored, so a notice there would not be in the tree and would be rewritten by the next build. Added to package.json files, or it would not ship to npm at all: there is no .npmignore fallback, files is an allowlist.

The licence texts are fetched, not recalled

Both are transcribed verbatim from upstream via the GitHub API. One of them turned up an incomplete upstream record, stated plainly rather than papered over:

• semantic-ui-less ships no licence file at all. Its package.json declares "license": "MIT" and "author": "Jack Lukic <jack@semantic-ui.com>", and the Semantic-UI-LESS repository has no LICENSE either — GitHub's licence API returns 404 for it.
• The licence text therefore comes from Semantic-Org/Semantic-UI, which these LESS definitions are published from — and that file contains no Copyright (c) line of its own, only the permission text. It is reproduced exactly as upstream publishes it, with the author recorded from the package manifest rather than invented. Writing a plausible-looking copyright line would have been the easy thing and the wrong one.
• normalize.css v7.0.0 does carry a holder line, fetched verbatim: Copyright © Nicolas Gallagher and Jonathan Neal. It is in scope because definitions/globals/reset is largely normalize.css, and its one-line banner already travels into our compiled output.

One unrelated defect fixed while in the manifest

"license": "Apache 2.0" → "Apache-2.0". The former is not a valid SPDX expression, and it is what npm publishes as this package's licence metadata.

Context: where step 4's second half stands

Measured since the parity gate landed, and it changed the method:

• globals/reset compiles to an exact byte-substring of the full build (26,224 bytes) — liftable verbatim.
• modules/dropdown does not — only 42.4% matches contiguously, because our :extend rules rewrite Semantic's selector lists. So the vendored CSS has to come from subtraction against the full build (what the fixture generator already does), and be placed as .less so :extend still reaches it.
• Vendoring the LESS source instead is not viable: dropdown.less is 1,422 lines reading 210 distinct variables through the theme cascade this step exists to delete.
• Theming cost of baking, measured: of 727 contributed declarations, @size-base-px moves 63, @size-scale 41, @radius-base 19 — about 17% stop tracking those tokens. Our own override/modules/dropdown.overrides (251 lines) stays LESS, so our design layer keeps full theming.

🤖 Generated with Claude Code