The standalone builds carry their own licences, and everyone else's

The five installers bundled Cascadia's font licence and nothing else --
not MeshTerm's own LICENSE and NOTICE, not the MIT/BSD/PSF notices
Apache-2.0 and those licences all want kept with a redistributed copy.
packaging/notices.py walks the mesh-term distribution's actual runtime
dependency closure through importlib.metadata (markers evaluated for
this platform, the dev extra excluded), gathers each package's licence
text, and fails the build loudly if one is missing rather than shipping
a silent gap -- which is exactly what it found: pyserial and the nine
winrt-* packages bleak's Windows backend pulls in all declare a licence
but ship no licence file in their wheel at all. Their real text, pulled
from each project's own repository, is vendored under
packaging/vendored-licenses/ for those two documented, verified gaps;
anything else missing still stops the build.

The spec generates THIRD-PARTY-NOTICES.txt fresh into the build
directory on every run and bundles it at the archive root alongside
LICENSE and NOTICE. installers.yml uploads the same three files once,
from the linux-x64 leg, so they land beside the downloads on the
release page too, without extracting an installer just to read them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/installers.yml

@@ -69,6 +69,37 @@ jobs:
         working-directory: packaging
         run: pyinstaller --clean --noconfirm meshterm.spec
 
+      # `packaging/meshterm.spec` regenerates `THIRD-PARTY-NOTICES.txt` fresh on every
+      # leg's own build (see `packaging/notices.py`) and bundles it, along with LICENSE
+      # and NOTICE, inside that leg's own installer -- so each downloaded binary always
+      # carries an accurate copy of what it actually contains. This step is a separate
+      # convenience: the same three files land on the release page itself, next to the
+      # downloads, so nobody has to extract an installer just to read a license. One
+      # copy serves every platform there (LICENSE/NOTICE never vary, and the runtime
+      # dependency closures differ only in a handful of platform-specific packages), so
+      # it rides on this leg alone rather than being uploaded -- and attached to the
+      # release -- five identical-in-substance times over. linux-x64 was picked
+      # arbitrarily among the five; nothing here is Linux-specific.
+      - name: Upload the licences for the release page
+        if: matrix.label == 'linux-x64'
+        shell: bash
+        run: |
+          # `build/<specname>/` is PyInstaller's own workpath layout (see the spec's
+          # comment on `workpath`), not something worth this step knowing by heart
+          # twice -- copy it flat, next to LICENSE and NOTICE, so the artifact (and,
+          # via `find`, the release assets built from it) is three plain files.
+          cp packaging/build/meshterm/THIRD-PARTY-NOTICES.txt .
+
+      - uses: actions/upload-artifact@v4
+        if: matrix.label == 'linux-x64'
+        with:
+          name: meshterm-licenses
+          path: |
+            LICENSE
+            NOTICE
+            THIRD-PARTY-NOTICES.txt
+          if-no-files-found: error
+
       - name: Check it actually runs
         shell: bash
         run: |