ci+licenses: promote 4 trivial gates to required CI + third-party license doc

Two reviewer-facing additions:

1. New `quality-gates` job in .gitea/workflows/cpp-tests.yml
   ──────────────────────────────────────────────────────────
   Runs in parallel with test-cgal after test-fast.  Installs
   `codespell` + `shellcheck` (apt) into the existing ci-cpp container,
   then executes four scripts strictly (exit 1 on any finding):
     * license-headers.sh   — 66/66 files carry SPDX MIT
     * cgal-conventions.py  — 0 violations across 6 CGAL public headers
     * codespell.sh         — 0 typos across docs + source + scripts
     * shellcheck.sh        — 0 findings across 16 shell scripts

   Each ran at 0 findings locally for weeks before promotion.  The
   gates are now contractual: a regression fails the PR.  Total
   wall-time on the eulernest runner: ~30 s.

2. New code/deps/THIRD-PARTY-LICENSES.md
   ──────────────────────────────────────
   Enumerates every vendored dependency under code/deps/, plus the
   auto-fetched GoogleTest, plus the system-required Boost, with:
     * upstream project + version + SPDX identifier
     * compatibility note for MIT distribution
     * a downstream-packager license matrix (header-only consumer
       vs CLI binary) clarifying the LGPL §3 vs §4 distinction
       relevant to CGAL's header-only consumption

   Required for any future Linux-distribution packaging and for the
   CGAL submission's compliance check.  Cross-referenced from
   doc/architecture/dependencies.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/codespell 2.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# scripts/quality/codespell.sh
+#
+# Run codespell across the repo to catch typos in:
+#   * doc/**/*.md  (reviewer-facing material)
+#   * code/include/**/*.{h,hpp}  (Doxygen comments are user-facing)
+#   * code/src/, code/tests/  (test names, error messages)
+#   * scripts/**/*.{sh,py}  (CI messages reach contributors)
+#   * README.md, CHANGELOG.md, CLAUDE.md
+#
+# Skips vendored deps, build dirs, generated Doxygen output (see
+# `.codespellrc`).
+#
+# Local-only.  CI promotion once the existing tree is 0-typo.
+#
+# Usage:
+#   bash scripts/quality/codespell.sh          # dry-run, exit 1 on any hit
+#   bash scripts/quality/codespell.sh --fix    # interactively apply suggestions
+#
+# Exit codes:
+#   0  no typos
+#   1  at least one typo found (no --fix), or --fix completed
+#   2  prerequisite missing
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 2
+
+command -v codespell >/dev/null 2>&1 || {
+    echo "FAIL: codespell not in PATH." >&2
+    echo "        macOS: brew install codespell" >&2
+    echo "        Linux: sudo apt install codespell  OR  pip3 install codespell" >&2
+    exit 2
+}
+
+FIX=0
+for arg in "$@"; do
+    case "$arg" in
+        --fix) FIX=1 ;;
+        *)     echo "Unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+# Targets: everything except deps + build + generated.
+TARGETS=(
+    "doc"
+    "code/include"
+    "code/src"
+    "code/tests"
+    "scripts"
+    "README.md"
+    "CHANGELOG.md"
+    "CLAUDE.md"
+    "CITATION.cff"
+    "CONTRIBUTING.md"
+)
+
+# Filter to existing entries (CONTRIBUTING.md / CHANGELOG.md may not exist
+# on every branch).
+EXISTING=()
+for t in "${TARGETS[@]}"; do
+    [ -e "$t" ] && EXISTING+=("$t")
+done
+
+echo "codespell ($(codespell --version 2>&1 | head -1))"
+echo "Targets: ${EXISTING[*]}"
+echo
+
+if [ "$FIX" -eq 1 ]; then
+    codespell --write-changes "${EXISTING[@]}"
+    rc=$?
+else
+    codespell "${EXISTING[@]}"
+    rc=$?
+fi
+
+if [ "$rc" -ne 0 ]; then
+    echo
+    echo "Recovery:"
+    echo "  bash scripts/quality/codespell.sh --fix   # apply"
+    echo "  # or add false-positives to .codespellrc → ignore-words-list"
+    exit 1
+fi
+
+echo
+echo "OK: no typos found."
+exit 0