Add RootFS license/NOTICE candidate bundle

[jacklv-coder]

Summary

• add a checksum-bound external LICENSE/NOTICE candidate manifest for the 8 remaining RootFS source origins
• add strict validation and an outside-repository atomic materializer/verifier for 21 reviewed evidence files, 8 remote payloads, and 46 supplemental aports files
• integrate the candidate index into reproducible compliance outputs, CI, and bilingual release documentation

Candidate payloads remain outside Git. Engineering review approval, legal review, and redistribution approval remain false.

Validation

• full Ruby/shell RootFS script suite
• real external source-review + license-review candidate bundle verification
• real HTTPS streaming download with pinned byte count and SHA-256
• reproducible compliance generation/check from pinned v0.3.3 archive
• swift test (139 tests, 1 expected skip, 0 failures)
• pinned RootFS release-asset Swift test
• bilingual documentation check and git diff --check
• Codex CR after fixes: no actionable correctness findings

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aaf3618b18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle Net::HTTP connection errors before trying fallback URLs

When an HTTPS proxy rejects the CONNECT request or Net::HTTP encounters a protocol-level failure, Net::HTTP.start can raise Net::HTTPClientException/Net::HTTPFatalError, which this rescue list does not convert to BundleError. Consequently, fetch_remote_payload cannot record the failure and try the next pinned URL, and the top-level handler emits an uncaught stack trace instead of a controlled materialization error. This occurs, for example, with a proxy returning HTTP 403 during connection setup.

Useful? React with 👍 / 👎.