Add source repository manifest (#46)

Adds MANIFEST.md documenting the composition of this repository for OSS
compliance: application identity, Cargo dependency table (name/version/
SPDX license), shipped binaries, runtime-downloaded assets, and
per-directory structure notes.

Adds cargo xtask manifest to regenerate the dependency table in place from
cargo metadata, and cargo xtask manifest --check wired into CI to fail if
the table drifts.

splice_table searches for MANIFEST_END starting after MANIFEST_BEGIN so
an earlier occurrence of the marker text cannot accidentally splice the
wrong region.

Author: rominf

.github/workflows/ci.yml

@@ -131,7 +131,10 @@ jobs:
       - uses: actions-rust-lang/setup-rust-toolchain@v1
 
       - name: Clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+
+      - name: MANIFEST.md dependency table is current
+        run: cargo xtask manifest --check
 
   coverage:
     name: Coverage (rocm-dash crates, ratcheted)