Summary

• Generate target-specific Python and Go legal metadata from the locked dependency graph.
• Merge required Apache dependency notices, including Apache Avro, Arrow, DataFusion, and Object Store.
• Record statically linked XZ Utils 5.8.3 under 0BSD in every Python wheel report.
• Package and byte-verify legal files in Python and Go release artifacts.
• Refresh all reports on the final OpenDAL 0.58 and AWS-LC dependency tree.

Stack

• Depends on build(python): give RC artifacts unique versions #557 for unique Python RC versions.
• Depends on build: lock and verify release dependencies #558 for the locked and audited dependency tree.
• Depends on build: harden Rust crate publishing #562 for the final Rust package layout.
• Replaces the closed mixed-scope build: harden release artifact licensing #554.

The branch contains the dependency and Rust packaging commits so legal reports cannot go stale. After the stacked PRs merge, only the binding legal commits remain in this diff.

Verification

• python3.11 scripts/release_licenses.py
• python3.11 scripts/release_licenses.py --check
• python3.11 scripts/dependencies.py verify
• cargo deny --locked --all-features check --warn unmaintained advisories licenses
• PYO3_PYTHON=python3.11 cargo check --workspace --locked
• Python five-target and Go four-target legal artifact checks
• actionlint, YAML parsing, and git diff --check