Restore the notices proof that reads a tree with a dependency added (#37)

[iderex]

Refs #37

What this changes

It puts cmd/notices/tree_test.go back on the default branch. The file landed in
82c245fbce624dd7c1749891702da68758345a4e and is not in the tree today:

git log --diff-filter=D --format='%H %s' origin/main -- cmd/notices/tree_test.go
d3edfc95b8526033c79cb26afe48282c2c090e32 Name the version the pinned commit actually is (#151)

That commit is described by its message as a change to how one workflow pin is
commented, and it removes seven paths. What it did to the other six is outside
this change and is written up in #155.

The bytes here are the bytes that were on the default branch, not a rewrite of
them:

git rev-parse 90656ba:cmd/notices/tree_test.go
8415e80f25bda8d536e575d39f7e34330e018eae
git hash-object cmd/notices/tree_test.go
8415e80f25bda8d536e575d39f7e34330e018eae

The means is Go, and it is the means the artefact already had. This restores a
file the suite under cmd/notices already compiles, so it adds no language, no
runtime and no dependency, and it is testable by the suite that exists rather
than by a parallel one.

What failure it prevents

A build read wrongly reaching the notices document with nothing to catch it.

buildOf in cmd/notices/main.go collects the modules the toolchain recorded
inside a binary. With line 137, build.Deps = append(build.Deps, module),
replaced by a discard, the default branch as it stands runs green in all eleven
packages:

go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	0.709s
ok  	github.com/Flowfin/lab/cmd/lab	1.183s
ok  	github.com/Flowfin/lab/cmd/notices	4.174s
ok  	github.com/Flowfin/lab/cmd/pullrequest	2.363s
ok  	github.com/Flowfin/lab/internal/check	1.147s
ok  	github.com/Flowfin/lab/internal/contexts	1.894s
ok  	github.com/Flowfin/lab/internal/hardware	1.868s
ok  	github.com/Flowfin/lab/internal/invariants	1.717s
ok  	github.com/Flowfin/lab/internal/notices	2.062s
ok  	github.com/Flowfin/lab/internal/prose	1.189s
ok  	github.com/Flowfin/lab/internal/pullrequest	2.359s

Every package there is green because none of them starts from a tree. The two
neighbours in cmd/notices read a binary built from this repository, which has
no third-party module, so a collector that drops everything and a collector that
works produce the same document: the one saying there is nothing to disclose.
internal/notices writes its module sets out in full, so it never runs the
collector at all.

With the file back, the same one-line edit reddens exactly one test and leaves
its two neighbours alone:

go test -count=1 -v ./cmd/notices
--- PASS: TestTheModuleTableOfARealBinaryReachesTheDocument (1.61s)
--- PASS: TestABrokenInvocationIsNotARefusal (1.16s)
--- FAIL: TestATreeWithADependencyAddedProducesADocumentThatListsIt (3.32s)

and across the module it reddens cmd/notices and nothing else:

go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	2.002s
ok  	github.com/Flowfin/lab/cmd/lab	1.933s
--- FAIL: TestATreeWithADependencyAddedProducesADocumentThatListsIt (3.14s)
FAIL	github.com/Flowfin/lab/cmd/notices	7.923s
ok  	github.com/Flowfin/lab/cmd/pullrequest	2.609s
ok  	github.com/Flowfin/lab/internal/check	1.341s
ok  	github.com/Flowfin/lab/internal/contexts	1.702s
ok  	github.com/Flowfin/lab/internal/hardware	1.191s
ok  	github.com/Flowfin/lab/internal/invariants	1.569s
ok  	github.com/Flowfin/lab/internal/notices	2.412s
ok  	github.com/Flowfin/lab/internal/prose	1.516s
ok  	github.com/Flowfin/lab/internal/pullrequest	2.684s

cmd/notices/main.go is untouched by this change. The edit above was made to
measure the difference and reverted before the commit:

git diff --name-only origin/main...HEAD
cmd/notices/tree_test.go

There is a second failure the absence carried, and it is about what a reader is
entitled to believe. Two notes on #37 say the third leg of its done-when is
landed on the default branch. Until this merges, that is not true of the branch
a reader will check out.

What was run

At 9f1ad61de2d27d66946e823b3d5f23546aa6e6db, on Windows, with no graphical
session and as an ordinary user:

go build ./cmd/... ./internal/...
go vet ./cmd/... ./internal/...
gofmt -l cmd internal
go test -count=1 ./cmd/... ./internal/...
ok  	github.com/Flowfin/lab/cmd/contexts	1.956s
ok  	github.com/Flowfin/lab/cmd/lab	3.130s
ok  	github.com/Flowfin/lab/cmd/notices	8.466s
ok  	github.com/Flowfin/lab/cmd/pullrequest	3.039s
ok  	github.com/Flowfin/lab/internal/check	2.306s
ok  	github.com/Flowfin/lab/internal/contexts	1.288s
ok  	github.com/Flowfin/lab/internal/hardware	2.153s
ok  	github.com/Flowfin/lab/internal/invariants	2.041s
ok  	github.com/Flowfin/lab/internal/notices	1.376s
ok  	github.com/Flowfin/lab/internal/prose	2.345s
ok  	github.com/Flowfin/lab/internal/pullrequest	2.863s

go build, go vet and gofmt -l each printed nothing, which is the passing
result for all three.

go run ./cmd/lab check .
examined .
1 experiment directory walked, 1 record read
18 decision records read
the time this run read is 2026-08-21T03:42:32Z
0 refused

The suite ran on one platform. The other two the build covers were not run here
and the jobs on this pull request are what covers them.

What this does not do

It does not finish #37. That issue's two remaining legs ask for the notices and
the bill of materials to be generated by the release build and attached to the
release, and there is no release workflow in this tree and no release:

gh api repos/Flowfin/lab/releases --jq 'length'
0

Both of those sit behind #41, which is unstarted for a reason written on it.

It restores one of the seven paths that commit removed and leaves the other six
alone, because they belong to other issues and to work running beside this. What
is missing from each of them, with the commands, is #155.

It does not touch the collector the test judges, so nothing here makes the
notices document more correct. What changes is that a wrong one would be caught.

No second person has read this change. The evidence above stands in place of
that reading rather than beside it.