[wolfy-j]

Run the shared third-party notice and SPDX-header checker in CI, pinned to validated commit e1186b6a3f9aac84125b7d5300077b7b23a70804. It retains the artifact-aware dependency inventory and safely validates source aliases. Checkout credentials remain disabled and the existing build, lint, test and package checks are retained.

The copied publishing handbook is synchronized through make sync-handbook with the canonical source so its provenance check passes. Runtime code and release metadata are unchanged.

Validation: make check check-handbook passes, including template initialization and release workflow/delivery checks. The added legal gate and SQLite/PostgreSQL CI must pass on this updated head before merge.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}