AASM SMB helper upstream notices and attributions

Verbatim upstream licence/copyright/notice text and exact provenance for the selected native payload are included here. Application-owned code retains its existing application terms. No new application-code licence or legal approval is supplied.

INDEX.json maps each native file to notices and source provenance. NATIVE_PAYLOAD.json binds the selected production payload. Cryptography Rust OpenSSL4.0.3 and Windows CPython OpenSSL3.5.9 are separately attributed. The Nuitka Runtime Library Exception accompanies its licence. Extra Cargo notices reflect the upstream all-target build graph.

The verifier checks exact bytes, a closed selected-platform directory, and native-payload binding. It does not adjudicate licence entitlements. Research limits and supplied-text limitations remain in INDEX.json. No compiler, QA helper, test server, credentials, customer licence, or application source is included.
