docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section

[danielmeppiel]

Summary

Two changes, one file rename.

1. Rename NOTICE.md -> NOTICE

Aligns with the Apache / CNCF convention used by upstream third-party-attribution files (kubernetes-sigs/kro, kubernetes-sigs/headlamp, Apache projects, etc.). The .md extension was non-idiomatic for a generated legal artifact -- license scanners and SBOM generators match on the bare NOTICE filename.

Updated everywhere:

• scripts/generate-notice.py (NOTICE_OUT constant + all docstring / error / --check strings)
• Makefile (make notice target reference)
• .github/workflows/notice-drift.yml (workflow comments, step name)
• CHANGELOG.md

2. NOTICE: add 'Submitted on behalf of a third-party' section

When the repo transferred from danielmeppiel/awd-cli to the microsoft org, several PRs had already merged from contributors for whom the microsoft-github-policy-service CLA bot did not record a signature. We could not retroactively reach all of them.

Per industry convention (CNCF NOTICE files mirror this exact wording from section 7 of common CLA texts), each such contribution is identified as submitted on behalf of a third-party.

Driven by a new _third_party_submissions block in scripts/notice-metadata.yaml -- legally-significant text stays alongside per-component data, not hidden in code.

Contributors named

Verified via the GitHub Check Runs API against the microsoft-github-policy-service app's license/cla check, on every merged PR by each suspected author. None has a successful CLA check on file:

Contributor	PRs	Evidence
@pofallon	#4	No CLA check-run recorded (predates bot)
@richgo	#8, #25, #26, #33, #34	No CLA check-run recorded (predates bot)
@ryanfk	#92	Check-run present, output.title = 'Contributor License Agreement is not agreed yet.'
@foutoucour	#108	No CLA check-run recorded
@Jah-yee	#184	No CLA check-run recorded

Listed contributors who later sign the CLA -- or who were signed under a different GitHub account at the time -- can request removal via issue.

Verification

• uv run python scripts/generate-notice.py --check exits 0 (NOTICE is up to date).
• NOTICE Drift Check workflow updated to operate on the renamed path; expected to pass.
• No src//tests/ code changes -> Lint / Build & Test untouched.

Out of scope

• The audit-drift follow-up tracked in Fold integration drift gate into 'apm audit --drift' (or 'apm install --check') #1071 (apm audit --drift / apm install --check).

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Renames the repository’s third-party attribution artifact from NOTICE.md to extension-less NOTICE and extends the NOTICE generator/metadata to include a “Submitted on behalf of a third-party” contributor section.

Changes:

• Rename NOTICE output path to NOTICE and update the generator, Makefile targets, and CI drift workflow accordingly.
• Add a _third_party_submissions metadata block and render it into the generated NOTICE.
• Add Unreleased changelog entries describing the rename and the new NOTICE section.

Show a summary per file

File	Description
scripts/notice-metadata.yaml	Adds _third_party_submissions block (preamble + contributor PR lists) to drive new NOTICE content.
scripts/generate-notice.py	Changes output filename to NOTICE and implements parsing/rendering of third-party submissions.
NOTICE	Updates generated artifact to include the new third-party submissions section.
Makefile	Updates comments/documentation to refer to NOTICE instead of NOTICE.md.
CHANGELOG.md	Adds Unreleased entries documenting the rename and new NOTICE section.
.github/workflows/notice-drift.yml	Updates workflow comments/step names to refer to NOTICE and continues to run the generator in --check mode.

Copilot's findings

Comments suppressed due to low confidence (2)

scripts/generate-notice.py:363

• The comment says the NOTICE file ends with ---\n\n, but when the third-party submissions section is appended the file no longer ends with that delimiter (and the extra section formatting changes the end-of-file structure). Please either update this comment to reflect the new output or adjust the renderer so the file still ends with the expected trailing delimiter when tps is present.

        # Trailing blank line between components (and after the last one)
        # to match the CELA template -- the file ends `---\n\n`.
        out.append("\n")
    if tps is not None and tps.contributors:
        out.append(render_third_party_submissions(tps))

NOTICE:1220

• There are two consecutive section delimiters (---) here before the new third-party submissions section. This looks like an output-formatting bug in the generator (the last dependency section already ends with ---, and the new section starts with another). Please adjust generation so only one delimiter is emitted, then re-run make notice.

• Files reviewed: 6/6 changed files
• Comments generated: 3

[Copilot]

NOTICE_OUT was renamed to NOTICE, but this module still contains several references to NOTICE.md in the top-level docstring and other docstrings/comments. Please update those remaining mentions to NOTICE so the script's documentation matches the new filename.

This issue also appears on line 359 of the same file.

[Copilot]

render_third_party_submissions() begins with a --- separator, but every component section already ends with ---\n\n (via render_component() + the trailing blank line in render_notice()). This currently generates two consecutive --- lines in NOTICE. Consider emitting only a single separator between the last component and the third-party section (e.g., drop the leading --- here or conditionally omit the extra separator/blank line in render_notice).

[Copilot]

These new Unreleased changelog bullets don't end with a PR reference like (#NNNN). This repo's changelog entries are consistently tagged with PR numbers, so please append the appropriate (#PR_NUMBER) suffix to each new line.