952eea9f1f
Structural layer: drop the hardcoded component list — any directory containing vendored source or data files must now be covered by a license file in itself or an ancestor within the vendored tree, so newly vendored code without a license fails immediately. New third layer: the graph-UI npm production tree is resolved (postinstall scripts disabled) and every bundled package must be on the policy allow-list; unknown licenses fail. Reclassifies @tailwindcss/vite as a devDependency — it is a build plugin and was inflating the production tree with native tooling.