Fork tooling: the third-party code upstream carries, listed and checked

A few of upstream's dual-licensed files carry code from other projects
under MIT or BSD terms. The fork redistributes it, so their licenses
require the notices to travel with it. THIRD-PARTY.md reproduces them.

strip.py now reads the stripped tree's comments for another copyright
holder, another license, or a note that code came from somewhere else, and
names any file THIRD-PARTY.md doesn't cover. It reports, never fails: the
notice goes in with the merge that brings the release in.

On v0.16.22 it finds 14 files, all of them covered. The rest of the report
is byte-for-byte what the committed one says, so the scan disturbs nothing
it already did.

docs/spec/SPEC.md

@@ -85,7 +85,13 @@ The wrapper is `tools/fork/strip.py`. Beyond `ossify.py` it:
   don't compile until they're gone;
 - verifies the result across every text file, not just Rust, and reports what
   was removed, the Cargo edits, upstream's Enterprise flags, and the feature
-  gates left for §2.3 to replace.
+  gates left for §2.3 to replace;
+- lists the third-party code left in the stripped tree, as upstream's
+  comments mark it: another copyright holder or license, or a note that code
+  was ported or adapted from elsewhere. Any file `THIRD-PARTY.md` doesn't
+  cover yet is flagged as new. It's reported, not a failure: the notice goes
+  into `THIRD-PARTY.md` in the merge that brings the release in, since the
+  fork redistributes that code and its license requires the notice.
 
 ### 2.2a Snapshots, not a git fork