fix(release): surface bundled JavaScript licenses

[bm1016bm-svg]

Surfaces webpack-generated third-party JavaScript notices in the wheel's standard license directory, so consumers do not have to discover them inside package data.

Changes

• include main.*.js.LICENSE.txt through PEP 639 license-files
• point wheel consumers to the bundled notices from LICENSE-wheel
• fail release artifact verification when the notices are absent

How I tested this

• python -m pytest tests/test_verify_apache_artifacts.py tests/test_release_config.py (20 passed)
• built a wheel with Flit and inspected it to confirm the notice appears under .dist-info/licenses/burr/tracking/server/build/static/js/

Notes

Closes #756.

Checklist

• PR has an informative and human-readable title
• Changes are limited to a single goal
• Relevant checks and tests pass
• The functionality change is tested
• New helper behavior is self-describing and covered by tests
• No placeholder code was added
• License documentation was updated

[jernejfrank]

This makes the entire CI matrix fail before tests run. The new license-
files glob points into the gitignored burr/tracking/server/build
directory, which is absent in a clean checkout, so Flit errors with No
files found for [project.license-files]. Could we store the license
notice at a stable, committed path instead?

[bm1016bm-svg]

Addressed: the bundled UI notice now lives at the committed root-level LICENSE-bundled-js path, and both wheel metadata and release validation use that stable file. The focused suite passes (18 tests), and a wheel build includes all four expected license files. The new Apache Actions runs currently require maintainer approval before jobs can start.