Implement reproducible release dependencies and third-party notices

[eimexdev]

Part of OpenBeat v0.1.0 public launch map.

Question

What repository and CI changes implement the approach selected by Choose a reproducible-build and bundled-license strategy?

Completion signal

• Release builds use a known dependency set.
• Dependency updates are deliberate.
• The resolved versions are recorded.
• Required third-party licenses or notices are shipped or linked in the agreed form.