ci+licenses: promote 4 trivial gates to required CI + third-party license doc

Two reviewer-facing additions:

1. New `quality-gates` job in .gitea/workflows/cpp-tests.yml
   ──────────────────────────────────────────────────────────
   Runs in parallel with test-cgal after test-fast.  Installs
   `codespell` + `shellcheck` (apt) into the existing ci-cpp container,
   then executes four scripts strictly (exit 1 on any finding):
     * license-headers.sh   — 66/66 files carry SPDX MIT
     * cgal-conventions.py  — 0 violations across 6 CGAL public headers
     * codespell.sh         — 0 typos across docs + source + scripts
     * shellcheck.sh        — 0 findings across 16 shell scripts

   Each ran at 0 findings locally for weeks before promotion.  The
   gates are now contractual: a regression fails the PR.  Total
   wall-time on the eulernest runner: ~30 s.

2. New code/deps/THIRD-PARTY-LICENSES.md
   ──────────────────────────────────────
   Enumerates every vendored dependency under code/deps/, plus the
   auto-fetched GoogleTest, plus the system-required Boost, with:
     * upstream project + version + SPDX identifier
     * compatibility note for MIT distribution
     * a downstream-packager license matrix (header-only consumer
       vs CLI binary) clarifying the LGPL §3 vs §4 distinction
       relevant to CGAL's header-only consumption

   Required for any future Linux-distribution packaging and for the
   CGAL submission's compliance check.  Cross-referenced from
   doc/architecture/dependencies.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/cppcheck 2.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# scripts/quality/cppcheck.sh
+#
+# Run cppcheck over the public headers.  Complementary to clang-tidy:
+# cppcheck has different heuristics, fewer false-positives on heavy
+# template code (CGAL/Eigen), and catches some bugs (unused includes,
+# memory leaks in detail/) that clang-tidy is bad at.
+#
+# Local-only.  Promotion to CI when the existing tree is finding-free
+# at the chosen severity level.
+#
+# Usage:
+#   bash scripts/quality/cppcheck.sh           # error+warning only
+#   bash scripts/quality/cppcheck.sh --strict  # +style, exit 1 on any
+#   bash scripts/quality/cppcheck.sh --all     # absolute everything,
+#                                                useful for diffs only
+#
+# Exit codes:
+#   0  no findings at the chosen severity, or findings but not --strict
+#   1  findings + --strict
+#   2  prerequisite missing
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 2
+
+command -v cppcheck >/dev/null 2>&1 || {
+    echo "FAIL: cppcheck not in PATH." >&2
+    echo "        macOS: brew install cppcheck" >&2
+    echo "        Linux: sudo apt install cppcheck" >&2
+    exit 2
+}
+
+STRICT=0
+ALL=0
+for arg in "$@"; do
+    case "$arg" in
+        --strict) STRICT=1 ;;
+        --all)    ALL=1 ;;
+        *) echo "Unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+ENABLE="warning"
+if [ "$STRICT" -eq 1 ]; then ENABLE="warning,style"; fi
+if [ "$ALL"    -eq 1 ]; then ENABLE="all"; fi
+
+BUILD_DIR="build-cppcheck"
+LOG="$BUILD_DIR/cppcheck.log"
+mkdir -p "$BUILD_DIR"
+
+echo "cppcheck ($(cppcheck --version 2>&1 | head -1))"
+echo "  enable:  $ENABLE"
+echo "  log:     $LOG"
+echo
+
+# Suppress noise classes that are not actionable in our project:
+#   missingIncludeSystem — CGAL/Eigen/Boost headers are intentionally
+#                          included implicitly; cppcheck cannot resolve.
+#   unmatchedSuppression — cosmetic.
+#   unusedFunction       — header-only; many `inline` helpers ARE used,
+#                          cppcheck can't see across TUs.
+#   normalCheckLevelMaxBranches — informational, not a finding.
+#
+# We point cppcheck at code/include/ only.  The deps tree is third-party
+# code and out of scope.
+
+cppcheck \
+    --enable="$ENABLE" \
+    --std=c++17 \
+    --quiet \
+    --error-exitcode=2 \
+    --inline-suppr \
+    --suppress=missingIncludeSystem \
+    --suppress=unmatchedSuppression \
+    --suppress=unusedFunction \
+    --suppress=normalCheckLevelMaxBranches \
+    -I code/include \
+    code/include 2>&1 | tee "$LOG"
+rc=$?
+
+echo
+echo "── Summary ──"
+n=$(grep -cE "\[(error|warning|style|performance|portability)\]" "$LOG" || true)
+echo "  total findings: $n"
+echo "  full log:       $LOG"
+
+if [ "$STRICT" -eq 1 ] && [ "$n" -gt 0 ]; then
+    exit 1
+fi
+if [ "$rc" -eq 2 ] && [ "$STRICT" -ne 1 ]; then
+    # cppcheck signalled "error" severity but caller didn't ask --strict.
+    echo
+    echo "NOTE: cppcheck reported an `error`-severity finding.  Even"
+    echo "      without --strict, please review the log."
+fi
+exit 0