chore(compliance): artifact-level third-party notices + BitNet.cpp interpretation credits (#1166)

[michalharakal]

Part of #1166 (the final gate of #1136) — the items that don't need a release or a model file.

What

• META-INF/THIRD-PARTY-NOTICES.md in skainet-backend-native-cpu (verified: lands in the jvm jar next to the bundled libskainet_kernels) and skainet-backend-jni-cpu (AAR) — NeoGPU copyright + full MIT text + the BitNet.cpp format-knowledge note. This is the artifact-level obligation reuse lint can't see: compiled copies of the vendored kernel travel in published artifacts.
• Interpretation credits for the I2_S wire format: BitNet.cpp (MIT, © Microsoft) named in I2sRepack.kt and the Constants.kt header, following the existing llama.cpp precedent.
• Vendor README cross-references the notices for re-vendoring hygiene.

#1166 checklist status after this PR

• ✅ reuse lint in CI — already existed (reuse-compliance.yml), green on every ternary PR
• ✅ Vendored file byte-identical — re-verified now: a560ffcf… matches the recorded anjaustin/neogpu@0846b24
• ✅ LICENSES/ audit — Apache-2.0 and CC0-1.0 are referenced (gradle wrapper, onnx-ml.proto3; FSFE/Scorecard workflows): justified, kept
• ✅ BitNet.cpp interpretation note (this PR)
• ✅ Artifact-level notices (this PR)
• ⬜ POM/release-notes mention + BOM — at release cut
• ⬜ Upstream courtesies (comment on Porting the ternary LUT kernel into SKaiNET (Kotlin Multiplatform ML runtime) — a few questions anjaustin/neogpu#1, "used by" PR) — proposed text in the tracking issue, needs the maintainer's go
• ⬜ Real microsoft/bitnet-b1.58-2B-4T GGUF verification — needs the model file
• ⬜ Close-out summary + CHANGELOG — at release cut

🤖 Generated with Claude Code

[michalharakal]

@MacOS re-requesting review — every thread is addressed on the branch:

• SPDX headers for the notice/README files → 5c4ea90 (and per your follow-up, the markdown files are CC0-1.0, not MIT → 36dc067d)
• "binaries in the repo?" → no; the notices cover compiled copies inside the published Maven artifacts (jar/klib/AAR), which is where MIT's notice obligation follows them. Nothing compiled is committed.
• "byte-identical after compilation?" → wording fixed in 36dc067d: byte-identical refers to the vendored source file (SHA-256-verifiable against upstream); the REUSE .license sidecar exists precisely so the hash-checked file needs no in-file header.
• Your two suggestions on Constants.kt / I2sRepack.kt → applied as committed (351f2e84, e2536293).

One consideration on that last point, for your call: under REUSE precedence = "closest" the in-file SPDX-FileCopyrightText: Microsoft now overrides the blanket SKaiNET attribution for those two files — recording clean-room reimplementations as © Microsoft. reuse lint stays green either way. If you'd rather keep the machine-readable attribution with the SKaiNET contributors (the llama.cpp precedent note deliberately carries no tags), say the word and I'll adjust; otherwise happy to leave your version.

CI is fully green on the head, including test-reuse-compliance.