build(site): [SITE-07] reproduce historical Unicode data and ship source notices

refactor/third-party.json

@@ -512,11 +512,13 @@
         "SITE-05"
       ],
       "sourceStatus": "Monaco 0.30.1 verified against official npm archive: 98 byte-exact files, one CSS newline-only difference. The bundled font additionally matches @vscode/codicons 0.0.26 exactly; see site-codicons-provenance.json.",
-      "licenseStatus": "Full Monaco root notices and Codicons historical notices are delivered. The actual TypeScript 4.4.4 worker is exactly reproduced and has a complete original LICENSE/CopyrightNotice/ThirdPartyNoticeText supplement plus attribution; the original stale 2.7.2 label is preserved with explanation. Other bundled-component completeness remains under VENDOR-06. No permission for unrelated fonts/media is inferred. CSS/HTML/JSON worker source proof now binds seven service packages to nine original license/third-party notice files, two embedded formatter headers and attribution. JSON glob BSD conditions and actual formatter author years are retained; all 81 site notices pass HTTP byte checks. Mode/core/basic-language and remaining embedded-source completeness stay open. All four language mode bundles are now exactly reproduced and the two shared npm dependencies are bound to those mode assets as well as workers. Core/basic-language and remaining upstream-origin review stay open. DOM adaptation supplement now delivers fixed WinJS4.4.5 reference terms and explicit unknown-original-version attribution; six fixed VS Code declaration blocks match the original source map.88 notice files plus index are served; remaining provenance is not waived.",
+      "licenseStatus": "Full Monaco root notices and Codicons historical notices are delivered. The actual TypeScript 4.4.4 worker is exactly reproduced and has a complete original LICENSE/CopyrightNotice/ThirdPartyNoticeText supplement plus attribution; the original stale 2.7.2 label is preserved with explanation. Other bundled-component completeness remains under VENDOR-06. No permission for unrelated fonts/media is inferred. CSS/HTML/JSON worker source proof now binds seven service packages to nine original license/third-party notice files, two embedded formatter headers and attribution. JSON glob BSD conditions and actual formatter author years are retained; all 81 site notices pass HTTP byte checks. Mode/core/basic-language and remaining embedded-source completeness stay open. All four language mode bundles are now exactly reproduced and the two shared npm dependencies are bound to those mode assets as well as workers. Core/basic-language and remaining upstream-origin review stay open. DOM adaptation supplement now delivers fixed WinJS4.4.5 reference terms and explicit unknown-original-version attribution; six fixed VS Code declaration blocks match the original source map.88 notice files plus index are served; remaining provenance is not waived. Unicode data supplement now delivers fixed historical Unicode terms and mixed-draft/input attribution; three original recipes reproduce all four selected expressions. Current notice delivery is 90 files plus index; remaining provenance is not waived.",
       "upstreamSources": [
         "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.30.1.tgz",
         "https://registry.npmjs.org/@vscode/codicons/-/codicons-0.0.26.tgz",
-        "https://github.com/winjs/winjs/tree/4329b1133b243d9ded3b5a1f98d096ee8e80e889"
+        "https://github.com/winjs/winjs/tree/4329b1133b243d9ded3b5a1f98d096ee8e80e889",
+        "https://github.com/alexdima/unicode-utils/tree/6d37cf4362203bfb5431c560cd8809b2cc3b51c1",
+        "https://github.com/unicode-org/unicodetools/blob/b1c21ef7e972ea0c783c19cf25494bde645fbf21/LICENSE"
       ],
       "upstreamReviewedAt": "2026-09-15",
       "updatePolicy": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",