ci+licenses: promote 4 trivial gates to required CI + THIRD-PARTY-LICENSES.md

Two reviewer-facing additions consolidated into one commit:

(1) New `quality-gates` job in .gitea/workflows/cpp-tests.yml
    ──────────────────────────────────────────────────────────
    Runs in parallel with test-cgal after test-fast.  Installs
    `codespell` + `shellcheck` (apt) into the existing ci-cpp container,
    then executes four scripts strictly (exit 1 on any finding):
      * license-headers.sh   — 66/66 files carry SPDX MIT
      * cgal-conventions.py  — 0 violations across 6 CGAL public headers
      * codespell.sh         — 0 typos across docs + source + scripts
      * shellcheck.sh        — 0 findings across 16 shell scripts

    Each ran at 0 findings locally before promotion.  Total wall-time
    on the eulernest runner: ~30 s.

(2) New code/deps/THIRD-PARTY-LICENSES.md
    ──────────────────────────────────────
    Enumerates every vendored dep under code/deps/, plus auto-fetched
    GoogleTest, plus system-required Boost, with:
      * upstream project + version + SPDX identifier
      * compatibility note for MIT distribution
      * downstream-packager license matrix (header-only consumer vs
        CLI binary) clarifying the LGPL §3 vs §4 distinction

    Required for any future Linux-distribution packaging and for the
    CGAL submission's compliance check.

    Also fixes a `code/.gitignore` gap: the `deps/*` wildcard was
    catching the new file; added `!deps/THIRD-PARTY-LICENSES.md` to
    the exclusion list so it's actually tracked.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/cpp-tests.yml

@@ -112,3 +112,51 @@ jobs:
       # the price of guaranteeing the documented workflow stays working.
       - name: End-to-end smoke test (scripts/try_it.sh)
         run: bash scripts/try_it.sh
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Job 3 — quality-gates  (style + convention block)
+#
+# Cheap, deterministic checks that should never break unless a contributor
+# introduces a regression.  Each gate is a script under scripts/quality/
+# and exits 0 only when its tree is clean.  These ran for weeks locally
+# at zero findings before being promoted here.
+#
+# Tools installed at job-start (the ci-cpp image already has python3 +
+# bash; we add codespell + shellcheck on top).  Total wall-time: ~30 s
+# on the eulernest runner.
+#
+# Strictly required for merges into main/dev — a regression fails the PR.
+# ─────────────────────────────────────────────────────────────────────────────
+  quality-gates:
+    needs: test-fast
+    runs-on: eulernest
+    container:
+      image: git.eulernest.eu/conformallab/ci-cpp:latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install codespell + shellcheck (job-local)
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            codespell shellcheck
+
+      - name: License headers (every C++ source carries MIT SPDX)
+        run: bash scripts/quality/license-headers.sh
+
+      - name: CGAL conventions (6 rules over CGAL public headers)
+        run: python3 scripts/quality/cgal-conventions.py
+
+      - name: codespell (docs + source comments + script messages)
+        run: bash scripts/quality/codespell.sh
+
+      - name: shellcheck (scripts/**/*.sh, severity=warning, strict)
+        run: bash scripts/quality/shellcheck.sh --strict
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "QUALITY ▸ all four gates passed."
+          echo "  see scripts/quality/README.md for the full catalogue"
+          echo "  (sanitizers, clang-tidy, coverage, etc. are local-only)"