Copilot instructions

1---
2applyTo: '{ThirdPartyNotices.txt,cli/ThirdPartyNotices.txt,cglicenses.json,cgmanifest.json}'
3---
4 
5# OSS License Review
6 
7When reviewing changes to these files, verify:
8 
9## ThirdPartyNotices.txt
10 
11- Every new entry has a license type header (e.g., "MIT License", "Apache License 2.0")
12- License text is present and non-empty for every entry
13- License text matches the declared license type (e.g., MIT-declared entry actually contains MIT license text, not Apache)
14- Removed entries are cleanly removed (no leftover fragments)
15- Entries are sorted alphabetically by package name
16 
17## cglicenses.json
18 
19- New overrides have a justification comment
20- No obviously stale entries for packages no longer in the dependency tree
21 
22## cgmanifest.json
23 
24- Package versions match what's actually installed
25- Repository URLs are valid and point to real source repositories
26- Newly added license identifiers should use SPDX format where possible
27- License identifiers match the corresponding ThirdPartyNotices.txt entries
28 
29## Red Flags
30 
31- Any **newly added** copyleft license (GPL, LGPL, AGPL) — flag immediately (existing copyleft entries like ffmpeg are pre-approved)
32- Any "UNKNOWN" or placeholder license text
33- License text that appears truncated or corrupted
34- A package declared as MIT but with Apache/BSD/other license text (or vice versa)
35