docs: sponsors section, and keep competitor notes out of the public repo

[yujiezhang-ops]

Closes #48. Addresses the actionable half of #49.

Sponsors section (#48)

Both READMEs get a Sponsors / 赞助 section before the licence section, with
the PPIO and Novita logos linking to each site. The logos live in
docs/assets/sponsors/ and are referenced with <img height="48"> rather than
Markdown image syntax, because the source files are 640×640 and Markdown gives
no way to constrain the rendered size. Both PNGs have an alpha channel, so they
read correctly on GitHub's light and dark themes.

Three things follow from adding a sponsor, and they are in this PR because
leaving any of them out would make the repository contradict itself:

providers.lock.json now declares the relationship. PPIO and Novita are
also the two built-in Providers, and both entries said relationship: "none"
with an empty disclosure. docs/public-site-operations.md names those fields
as the source of truth for commercial disclosure, so a README that thanks a
sponsor while the lock file denies any relationship would be two contradictory
public statements about the same fact. They now say sponsor and carry
disclosure text.

Both READMEs restate the boundary the policy already requires: sponsorship
does not affect Agent rank, compatibility conclusions, default selection, or
connection tests, and the built-in ordering lives in the lock file regardless.

The NOTICE trademark section had to split. It asserted that every mark in
the project implies no "endorsement, affiliation or sponsorship" — which a
sponsor logo contradicts by definition. Agent marks remain nominative use,
single-colour, fill="currentColor". Sponsor marks are now a separate,
permission-based case that keeps its published brand colours, appears only in
the two READMEs, and reaches no release binary: manifest_embed.go embeds the
lock files and frontend/dist, never docs/.

docs/assets/sponsors/asset-rights.json records source, owner, and SHA-256 per
logo, matching how the Agent marks are inventoried, since
docs/distribution-compliance-policy.md requires every third-party file to
answer for its provenance.

Competitor notes (#49)

docs/internal/cc-switch-reference-notes.md leaves the tracked set and stays on
the maintainer's machine. It is a teardown of CC Switch carrying internal
judgements ("do not move toward it", "the earlier note overstated this") and
quoting the other project's implementation scale — which reads differently once
the repository is public. Its row in docs/internal/README.md goes with it,
otherwise scripts/check-docs.py fails on the dangling relative link.

Note that #49's main subject needed no action: docs/status-dot-ui-plan.md was
never committed. It is listed in .git/info/exclude as a deliberately untracked
local plan, and git ls-tree HEAD docs/ contains only the three policy
documents, so no external reader would ever see it.

Open questions for the reviewer

• The rights manifest records basis: "permission-from-owner", inferred from the
  sponsors having supplied their own logos. If the actual basis differs (brand
  resource page, a brand guideline constraining usage), that field should say so.
• referral_url is left empty for both. Correct for sponsorship without
  referral revenue; if there is any, the field and the disclosure wording both
  need updating.

Verification

go build ./..., go vet ./..., go test ./... all pass. Frontend pnpm run test: 165 tests across 24 files. python3 scripts/check-docs.py passes on 48
files (links resolve, language split holds).
python3 scripts/generate_third_party_licenses.py --check exits 0.

Rebased onto c88881e.

🤖 Generated with Claude Code