[Enhancement]: Release — the exe bundles LGPL-3.0, Apache-2.0, MPL-2.0 and MIT code but ships none of their notices #2856

Problem

The single exe carries every package in Directory.Packages.props and their dependencies. Their licenses, as the restored packages declare them:

• NvAPIWrapper.Net 0.8.1.101: its readme says it is "released under the LGPLv3 license";
• Serilog 4.4.0, Serilog.Sinks.File 7.0.0 and HidSharp 2.6.4: Apache-2.0;
• LibreHardwareMonitorLib 0.9.6, DiskInfoToolkit 1.1.2, RAMSPDToolkit-NDD 1.4.2 and BlackSharp.Core 1.0.7: MPL-2.0;
• WPF-UI, CommunityToolkit.Mvvm, LiveChartsCore, SkiaSharp, H.NotifyIcon, TraceEvent and System.Management.Automation: MIT.

The .NET runtime pack and SkiaSharp's native assets also ship their own THIRD-PARTY-NOTICES files for the code they embed. These licenses ask for their notices and license texts to go with the binary. Today the repository tracks only LICENSE, About shows "MIT licensed" and opens that file, the release uploads the exe, its .sha256 and the SBOM, and the README says "Third-party components are listed in the SBOM published with every release." An SBOM names the components and their license ids; it does not carry the notices.

Proposed solution

• Generate a THIRD-PARTY-NOTICES.txt from the app's restore graph with a version-pinned tool (the way release.yml pins CycloneDX), including the runtime's and SkiaSharp's own notice files, and upload it with each release beside the SBOM.
• Embed it and open it from an "Open-source components" button on About.
• A guard that fails when a PackageVersion in the app's group has no section in the file, so a new dependency cannot ship without its notice; regenerate it when a bump changes the transitive graph.

Affected tab

About, release workflow, README.