chore(deps): regenerate third-party notices for the currency wave

Covers all five generated files, not just the root one: the four per-client
copies are scoped to the binaries their package installs, so they move
independently of the workspace-wide file.

Root: 571 -> 575 crates, reflecting this wave (skia-safe 0.99, the RustCrypto
digest-0.11 family, jni 0.22, x11rb 0.14, reis 0.7, xkbcommon 0.9, wasapi 0.24,
windows-service 0.8.1, x509-parser 0.18, rand 0.9, base64 0.23, libloading 0.9,
mdns-sd 0.21 + if-addrs 0.15, rcgen 0.14, criterion 0.8, android_logger 0.15).

The per-client diffs are much larger than the wave alone explains, because they
were never regenerated after #192: all four still attributed `ring` and named no
aws-lc-rs at all. Since #192 removed ring from the tree entirely, the shipped
Acknowledgements screens have been crediting a crypto library the clients do not
carry while omitting the one they do. They now catch up on both changes at once.
(`ring` still appears via the generator's deliberate `--all-features`
over-approximation, which sees quinn-proto's wasm-only edge; that is by design —
listing an unlinked crate is untidy, omitting a linked one is the failure the
file exists to prevent.)

Also stops gen-third-party-notices.sh preferring `cargo about` for the root file.
That preference was silently destructive: cargo-about only sees CARGO
dependencies, so it drops every VENDORED_TREES entry -- pyrowave, the Granite
subset, volk, Vulkan-Headers, the Font Awesome brand icons, Simple Icons -- which
are third-party sources shipped inside first-party crates under their own
licences. Measured today: cargo-about emitted 7,274 lines / ~514 crates with zero
mentions of volk, Vulkan-Headers or Font Awesome, against the python generator's
17,324 / 575 with all of them. Merely having cargo-about on PATH was enough to
degrade the file, so anyone regenerating after this commit would have undone it.
cargo-about remains what the CI licence gate runs -- that job asks a different
question (is every licence in the about.toml allowlist) and writes to /dev/null.

Both licence-gate legs pass: `cargo about generate about.hbs --fail` and the
drivers-workspace leg, RC=0.

scripts/gen-third-party-notices.sh

@@ -10,14 +10,22 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 OUT="${1:-THIRD-PARTY-NOTICES.txt}"
 
-if command -v cargo-about >/dev/null 2>&1; then
-    echo "==> cargo about generate -> $OUT" >&2
-    cargo about generate about.hbs --output-file "$OUT"
-else
-    echo "==> cargo-about not installed; using offline fallback" >&2
-    echo "    (install the full generator with: cargo install cargo-about)" >&2
-    python3 scripts/gen-third-party-notices.py --out "$OUT"
-fi
+# ⚠ The root file goes through the PYTHON generator, NOT `cargo about` — deliberately, and this
+# is not a fallback. `cargo about` only ever sees CARGO dependencies, so it silently omits the
+# VENDORED_TREES below: pyrowave, the Granite subset, volk, Vulkan-Headers, the Font Awesome brand
+# icons and Simple Icons. Those are third-party sources shipped INSIDE first-party crates, each
+# under its own licence, and dropping them from an attribution file is a legal regression rather
+# than an untidiness. Measured 2026-08-13: `cargo about` produced 7,274 lines / ~514 crates with
+# zero mentions of volk, Vulkan-Headers or Font Awesome, against the python generator's 17,324
+# lines / 575 crates with all of them. This script used to prefer cargo-about whenever it was
+# installed, so simply HAVING it on your PATH silently degraded the file.
+#
+# `cargo about` is still what the CI licence GATE runs (.gitea/workflows/audit.yml) — that job
+# checks every licence is in the about.toml allowlist and writes to /dev/null, which is a
+# different question from what this file must contain. If about.hbs ever learns to emit the
+# vendored trees, preferring cargo-about here again would be reasonable.
+echo "==> gen-third-party-notices.py -> $OUT" >&2
+python3 scripts/gen-third-party-notices.py --out "$OUT"
 echo "==> wrote $OUT" >&2
 
 # Regenerate the per-client in-tree copies. EVERY client has one now, because every client SHOWS