clarify licensing and release compliance

[germanua]

What changed

• Clarified that noncommercial forks and free redistribution are allowed while resale, paid redistribution, and commercial use require written permission.
• Added commercial licensing, donation, notice, legal, and contributor-license documentation while retaining germanua as the public rights-holder name.
• Generated exact Rust dependency notices from Cargo.lock and added reproducibility checks.
• Included project and third-party notices in AppImage, DEB, RPM, AUR, Flatpak, and user-installer outputs.
• Added pull-request acknowledgment, CI validation, packaging smoke checks, and release checklist requirements.

Why

The previous documents did not fully distinguish allowed noncommercial redistribution from prohibited resale, and binary package definitions did not consistently ship exact third-party notices. This prepares the project for donations and future official paid builds without changing runtime behavior.

Impact

There are no application behavior changes. Release artifacts now carry the required legal files, dependency-notice drift is checked in CI, and future external contributions explicitly grant the project owner rights needed for official commercial builds.

Validation

• cargo fmt --all --check
• cargo test --workspace --locked
• bash packaging/smoke-check.sh — 49 passed
• bash packaging/validate-metadata.sh
• YAML and shell syntax validation
• Deterministic THIRD_PARTY_NOTICES.html regeneration
• git diff --check