ci+licenses: promote 4 trivial gates to required CI + third-party license doc

Two reviewer-facing additions:

1. New `quality-gates` job in .gitea/workflows/cpp-tests.yml
   ──────────────────────────────────────────────────────────
   Runs in parallel with test-cgal after test-fast.  Installs
   `codespell` + `shellcheck` (apt) into the existing ci-cpp container,
   then executes four scripts strictly (exit 1 on any finding):
     * license-headers.sh   — 66/66 files carry SPDX MIT
     * cgal-conventions.py  — 0 violations across 6 CGAL public headers
     * codespell.sh         — 0 typos across docs + source + scripts
     * shellcheck.sh        — 0 findings across 16 shell scripts

   Each ran at 0 findings locally for weeks before promotion.  The
   gates are now contractual: a regression fails the PR.  Total
   wall-time on the eulernest runner: ~30 s.

2. New code/deps/THIRD-PARTY-LICENSES.md
   ──────────────────────────────────────
   Enumerates every vendored dependency under code/deps/, plus the
   auto-fetched GoogleTest, plus the system-required Boost, with:
     * upstream project + version + SPDX identifier
     * compatibility note for MIT distribution
     * a downstream-packager license matrix (header-only consumer
       vs CLI binary) clarifying the LGPL §3 vs §4 distinction
       relevant to CGAL's header-only consumption

   Required for any future Linux-distribution packaging and for the
   CGAL submission's compliance check.  Cross-referenced from
   doc/architecture/dependencies.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.cmake-format 2.yaml

@@ -0,0 +1,28 @@
+# conformallab++ cmake-format policy
+#
+# Drives the cmake-format / cmake-lint tools used by
+# scripts/quality/cmake-format.sh.  The defaults are deliberately
+# permissive — the goal is to catch the obvious style drift (mixed
+# 2-vs-4-space indent, inconsistent argument wrapping, undocumented
+# options) without forcing a rewrite of every CMakeLists.txt we have.
+
+format:
+  line_width: 100               # match .clang-format
+  tab_size: 4
+  use_tabchars: false
+  separate_ctrl_name_with_space: false
+  separate_fn_name_with_space: false
+  dangle_parens: false
+  command_case: lower           # lowercase commands (cgal/upstream convention)
+  keyword_case: upper           # KEYWORDS like PUBLIC/PRIVATE/INTERFACE in caps
+
+lint:
+  # Whitelist the disables we explicitly accept.
+  disabled_codes:
+    - C0103   # invalid variable name — we use CGAL_/conformallab_ prefixes
+    - C0301   # line too long — handled by line_width, not as a lint error
+    - C0111   # missing docstring on a function — most of ours are obvious
+
+  # Maximum allowed nesting of conditional blocks.  3 is conservative;
+  # raise if we ever genuinely need deeper.
+  max_conditionals_custom_parser: 3