[P1] Replace unaudited favicon assets and enforce an asset-rights manifest

[yujiezhang-ops]

Problem

Five redistributed Agent icons only record a website favicon URL and have no auditable copyright license or written redistribution permission: Claude, Cursor, Hermes, Kilo, and Aider. The files are inlined by Vite and embedded in the desktop binary, so this is redistribution rather than a remote reference.

Required change

Remove the five unaudited image files from release output and replace them with OneAgent-owned generic marks. Add a machine-checked asset-rights manifest so future third-party images cannot enter a release with only a source URL.

Acceptance criteria

• Claude, Cursor, Hermes, Kilo, and Aider no longer ship copied favicon bytes without permission evidence.
• Replacement marks are OneAgent-owned generic artwork or use an explicitly documented license/permission.
• A tracked rights manifest records owner, source, license/permission, and SHA-256 for every redistributed third-party image.
• Tests fail if a new image-backed Agent mark has no rights entry.
• NOTICE no longer claims that provenance alone makes the five assets safe to ship.
• Frontend tests and production build pass.

Evidence

• frontend/src/components/icons/agents.tsx:31-40 records only src and source.
• frontend/src/components/icons/agents.test.tsx:27-32 accepts any .svg or .png URL as provenance.
• frontend/vite.config.ts:15-18 inlines all image assets.