restructure licenses.yaml: self + runtime deps + dev deps

Three sections instead of one flat list. `self:` carries clide's own
MIT license (rendered first in the About screen so the user knows
what they're running before the dependency list). `dependencies:`
covers artefacts that actually ship in the binary — JetBrainsMono,
JosefinSans, yaml. `dev_dependencies:` tracks build-time tooling
(mocktail, alchemist, flutter_lints, lints, test) for audit
completeness without polluting the user-facing About panel.

Also backfilled the two root-package dev deps that were missed the
first pass: `lints: 5.0.0` and `test: 1.25.8` (root pubspec, not
app/). Root LICENSE mirrored into app/assets/LICENSE + declared as
a bundled asset so the About screen can read it at runtime (Flutter
can't reference paths above the package root).

D-042 updated to describe the three-section split and the dev-vs-
runtime distinction.

Co-Authored-By: Claude <noreply@anthropic.com>

decisions/tooling.md

@@ -18,10 +18,10 @@ Toolchain, supply chain, CI, ignore strategy.
 - **Cost:** PRs don't run CI yet; `make push-check` is the gate until activation.
 - **Raised by:** 2026-04-21 planning.
 
-### D-042: Bundled dependencies documented in `licenses.yaml`
+### D-042: Dependencies documented in `licenses.yaml`
 - **Date:** 2026-04-22
-- **Decision:** Every third-party artefact bundled into the clide binary — Dart packages, fonts, native supporter tools, bundled data — has an entry in `app/assets/licenses.yaml` with name, kind, version, homepage, license identifier, relative path to the bundled license text, and a one-line purpose. The file is shipped as a Flutter asset and rendered by the About screen (Tier 6). Adding a bundled dependency is a two-step commit: add the artefact **and** the corresponding `licenses.yaml` entry in the same changeset.
-- **Rationale:** Complements [D-031](#d-031-prefer-zero-deps-exact-pin). Prefer-zero-deps is a *budget*; `licenses.yaml` is the *visible consequence*. An extra row in the About screen is a review-time signal that the budget just grew. It also discharges the redistribution obligations bundled licenses impose (OFL, MIT, BSD all require preserving the license text alongside the binary) without ad-hoc NOTICE files.
+- **Decision:** `app/assets/licenses.yaml` has three sections: `self:` (clide's MIT license, rendered first in the About screen so the user knows what they're running), `dependencies:` (third-party artefacts that **ship in the binary** — fonts, runtime Dart packages, native supporter tools, bundled data), and `dev_dependencies:` (build-time-only tooling — test runners, mocks, lints, golden harness — tracked for audit but **not rendered** in the About screen because they don't reach the user). Each entry has name, kind, version, homepage, license identifier, and a one-line purpose; runtime entries also carry a `license_file:` pointer to the bundled license text so the About screen can display it verbatim. Adding any dependency is a two-step commit: add the artefact **and** the corresponding `licenses.yaml` entry in the same changeset, under the correct section.
+- **Rationale:** Complements [D-031](#d-031-prefer-zero-deps-exact-pin). Prefer-zero-deps is a *budget*; `licenses.yaml` is the *visible consequence*. An extra row in the About screen is a review-time signal that the shipped-binary surface grew. Splitting dev deps out keeps the user-facing list small and honest — a test framework is not something the user needs to see in About — while still documenting every supply-chain input for audit completeness. The runtime entries discharge the redistribution obligations bundled licenses impose (OFL, MIT, BSD all require preserving the license text alongside the binary) without ad-hoc NOTICE files.
 - **Cost:** One extra edit per dep. Zero tolerance for drift — an un-listed dep is a contributor-visible bug. Until the About screen lands at Tier 6, `licenses.yaml` is accurate but not rendered; the discipline applies from now regardless so Tier 6 inherits a clean list.
 - **Raised by:** 2026-04-22 planning (user-directed best practice).