Add embedded license viewer and AVIF notice guards

[frathe]

Summary

• embed the canonical third-party notices and expose them through an offline Help -> Licenses viewer
• add complete reviewed AVIF, native, WASI, and runtime notices with pinned provenance checks
• ensure release archives retain both the loose notice file and its complete bytes in each executable
• fix mouse-wheel scrolling over license blocks by using one vertical document scroller

Verification

• focused race suites for Help, AVIF notices, updater notices, and main
• make verify-build
• Windows amd64 cross-vet
• offline Licenses tests with network denied by macOS sandbox
• package smoke checks for macOS, Windows, Linux, and Store payloads on both architectures

Known qualification limits

• the complete race suite requires a native Linux/amd64 Docker daemon; this workstation provides Linux/aarch64
• signed MSIX/WACK and native Windows/Linux offline UI checks remain release qualifications
• historical libyuv and modified WASI SDK provenance limits are documented and tracked in todos.md

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

Qodana for Go

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T12:15:51.181462Z	47d8224	New commits
🔒 Security Review	✅ Completed 2026-09-22T12:18:16.216115Z	47d8224	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8a723aa736

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8a723aa736

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[frathe]

GitHub Codex review loop completed for 47d8224ef9f4b6a8c953a102f93c4f0745de5a61.

• Fixed the confirmed P2 finding in 47d8224: restored the displaced Windows similarity-cache follow-up verbatim, alongside the AVIF qualification work. Replied with verification evidence and resolved the thread. Updated the plan and removed the full Linux CI qualification from open work after CI satisfied it.
• Fresh Codex code review completed at 12:15:51 UTC and security review at 12:18:16 UTC on this head. No new findings; the connector posted its clean-review thumbs-up at 12:18:19 UTC. Review summary.
• CI 35725798843: validation, all four Linux race partitions, Windows tests, and both macOS native guard jobs passed.
• Qodana 35725798766: passed. Downloaded the report and inspected post-suppression qodana.sarif.json: zero results, with provenance identifying this exact head.
• CodeQL 35725798816: both analyses passed; no open code-scanning alerts for the PR. CI annotations only announce the upcoming GitHub runner-image migration.
• Local documentation verification passed: restored section matches the parent byte-for-byte, both open sections and their evidence links exist, and git diff --check is clean. No Go files changed in the fix. Fresh GoLand inspections were unavailable because the IDE reports source files outside its project content roots; the prior implementation inspection evidence remains in the plan.

The working tree is clean. Existing AVIF provenance, native offline UI, and signed Store/WACK qualifications remain tracked in todos.md. The PR remains open and unmerged.