ci+licenses: promote 4 trivial gates to required CI + third-party license doc

Two reviewer-facing additions:

1. New `quality-gates` job in .gitea/workflows/cpp-tests.yml
   ──────────────────────────────────────────────────────────
   Runs in parallel with test-cgal after test-fast.  Installs
   `codespell` + `shellcheck` (apt) into the existing ci-cpp container,
   then executes four scripts strictly (exit 1 on any finding):
     * license-headers.sh   — 66/66 files carry SPDX MIT
     * cgal-conventions.py  — 0 violations across 6 CGAL public headers
     * codespell.sh         — 0 typos across docs + source + scripts
     * shellcheck.sh        — 0 findings across 16 shell scripts

   Each ran at 0 findings locally for weeks before promotion.  The
   gates are now contractual: a regression fails the PR.  Total
   wall-time on the eulernest runner: ~30 s.

2. New code/deps/THIRD-PARTY-LICENSES.md
   ──────────────────────────────────────
   Enumerates every vendored dependency under code/deps/, plus the
   auto-fetched GoogleTest, plus the system-required Boost, with:
     * upstream project + version + SPDX identifier
     * compatibility note for MIT distribution
     * a downstream-packager license matrix (header-only consumer
       vs CLI binary) clarifying the LGPL §3 vs §4 distinction
       relevant to CGAL's header-only consumption

   Required for any future Linux-distribution packaging and for the
   CGAL submission's compliance check.  Cross-referenced from
   doc/architecture/dependencies.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/shellcheck 2.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# scripts/quality/shellcheck.sh
+#
+# Run shellcheck across every Bash script we own (scripts/**/*.sh).
+# Skips the macOS duplicate artefacts (` 2.sh`).
+#
+# Local-only.  CI promotion once every script is shellcheck-clean.
+#
+# Usage:
+#   bash scripts/quality/shellcheck.sh             # warn + advisory exit 0
+#   bash scripts/quality/shellcheck.sh --strict    # fail on any finding
+#
+# Exit codes:
+#   0  no findings, or findings but --strict not set
+#   1  --strict was set and shellcheck reported findings
+#   2  prerequisite missing
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT" || exit 2
+
+command -v shellcheck >/dev/null 2>&1 || {
+    echo "FAIL: shellcheck not in PATH." >&2
+    echo "        macOS: brew install shellcheck" >&2
+    echo "        Linux: sudo apt install shellcheck" >&2
+    exit 2
+}
+
+STRICT=0
+for arg in "$@"; do
+    case "$arg" in
+        --strict) STRICT=1 ;;
+        *) echo "Unknown arg: $arg" >&2; exit 2 ;;
+    esac
+done
+
+FILES="$(find scripts -name "*.sh" -type f 2>/dev/null \
+    | grep -v " 2\.sh" \
+    | sort)"
+
+if [ -z "$FILES" ]; then
+    echo "FAIL: no shell scripts found under scripts/" >&2
+    exit 2
+fi
+
+echo "shellcheck ($(shellcheck --version | sed -n '2p'))"
+echo "Scanning shell scripts under scripts/"
+echo
+
+n_total=0
+n_with_findings=0
+total_findings=0
+while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    n_total=$((n_total + 1))
+    # -S style: warnings + above (skip "info" and "style" noise).
+    out="$(shellcheck --severity=warning --shell=bash "$f" 2>&1)"
+    if [ -n "$out" ]; then
+        echo "── $f ──"
+        echo "$out"
+        echo
+        n_with_findings=$((n_with_findings + 1))
+        # rough count: one finding per "In <file> line N:" block
+        cnt=$(printf '%s' "$out" | grep -c "^In .* line")
+        total_findings=$((total_findings + cnt))
+    fi
+done <<EOF
+$FILES
+EOF
+
+echo "── Summary ──"
+echo "  scripts scanned:      $n_total"
+echo "  scripts with issues:  $n_with_findings"
+echo "  total findings:       $total_findings"
+
+if [ "$STRICT" -eq 1 ] && [ "$total_findings" -gt 0 ]; then
+    exit 1
+fi
+exit 0