ci+licenses: promote 4 trivial gates to required CI + THIRD-PARTY-LICENSES.md

Two reviewer-facing additions consolidated into one commit:

(1) New `quality-gates` job in .gitea/workflows/cpp-tests.yml
    ──────────────────────────────────────────────────────────
    Runs in parallel with test-cgal after test-fast.  Installs
    `codespell` + `shellcheck` (apt) into the existing ci-cpp container,
    then executes four scripts strictly (exit 1 on any finding):
      * license-headers.sh   — 66/66 files carry SPDX MIT
      * cgal-conventions.py  — 0 violations across 6 CGAL public headers
      * codespell.sh         — 0 typos across docs + source + scripts
      * shellcheck.sh        — 0 findings across 16 shell scripts

    Each ran at 0 findings locally before promotion.  Total wall-time
    on the eulernest runner: ~30 s.

(2) New code/deps/THIRD-PARTY-LICENSES.md
    ──────────────────────────────────────
    Enumerates every vendored dep under code/deps/, plus auto-fetched
    GoogleTest, plus system-required Boost, with:
      * upstream project + version + SPDX identifier
      * compatibility note for MIT distribution
      * downstream-packager license matrix (header-only consumer vs
        CLI binary) clarifying the LGPL §3 vs §4 distinction

    Required for any future Linux-distribution packaging and for the
    CGAL submission's compliance check.

    Also fixes a `code/.gitignore` gap: the `deps/*` wildcard was
    catching the new file; added `!deps/THIRD-PARTY-LICENSES.md` to
    the exclusion list so it's actually tracked.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

code/.gitignore

@@ -13,6 +13,7 @@ deps/*
 !deps/tarballs
 !deps/single_includes/
 !deps/CMakeLists.txt
+!deps/THIRD-PARTY-LICENSES.md
 
 # macOS iCloud Drive duplicates ("file 2.cpp", "file 2.hpp", …)
 * 2.*