A hand-maintained THIRD-PARTY-LICENSES drifts whenever the UI's
dependencies change. Collect the terms from package-lock.json and the
installed node_modules instead, failing when a shipped package is missing,
mismatched or has no license file. Inter's OFL moves beside the font since
it is not an npm package.
The collection now assembles into a staging directory and renames it on
success, so a failed run no longer leaves a partial output behind.
