Add pnpm dependency license bundles

[timkpaine]

Description

Add opt-in pnpm dependency license collection to hatch-js. licenses.destination selects a package-relative JSON bundle in the wheel. Collection runs after the JavaScript build, uses pnpm licenses list --json, and retains original license and notice texts without machine-specific paths or newline normalization.

Include development and optional dependencies by default because bundlers can ship code declared in dev dependencies. production-only selects pnpm's --prod listing without changing installation or build commands. Document the conservative graph scope, workspace/platform limits, and need for human compliance review.

Reject missing/invalid texts, malformed graphs, unsafe paths, destination collisions, and conflicting originals. Exact-name/version/license-expression previous overrides can fill missing files, including absent SEE LICENSE IN ... targets, while preserving existing notices. Notice-only overrides cannot satisfy the license requirement.

Force-include bundles in standard and editable wheels, preserve other hooks' outputs and forced-inclusion precedence, and remove temporary files after packaging. Skip sdists and SKIP_HATCH_JS. Existing npm/yarn/jlpm builds are unchanged; enabling collection for them fails explicitly.

Pin CI to pnpm 10.28.2 through the existing setup action. Add editables only to development dependencies for real editable-wheel tests. Runtime dependencies and project version are unchanged; no release or tag created.

Checked on macOS arm64 / Python 3.12.14:

• make lint, make coverage, make checks, and ty check pass: 73 tests, 96.6% repository coverage.
• Wheel built from sdist and twine validation pass; all 73 tests also pass from the installed wheel.
• Sixteen real packaging cases pass with both pnpm 10.28.2 and native pnpm 12.4.2: standard/editable wheels, all/production dependencies, LF/CRLF, and both custom-hook orders. Local tarball fixtures keep these tests offline.
• Regression tests reproduced absent bundles and the reviewed validation/packaging failures before fixes.

Implemented in an isolated worktree based on current upstream main 0f46f24; the original local checkout remains unchanged. Keeping this PR draft for review.

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactor / code cleanup
• CI / build configuration
• Other (describe below)

Checklist

• Linting passes (make lint)
• Tests pass (make test)
• New tests added for new functionality
• Documentation updated (if applicable)
• Changelog / version bump (if applicable)

[github-actions]

Test Results

73 tests  +69   73 ✅ +69   33s ⏱️ +31s
 1 suites ± 0    0 💤 ± 0 
 1 files   ± 0    0 ❌ ± 0 

Results for commit a15532d. ± Comparison against base commit 0f46f24.

[codecov]

Codecov Report

❌ Patch coverage is 98.50187% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.62%. Comparing base (0f46f24) to head (a15532d).

Files with missing lines	Patch %	Lines
hatch_js/licenses.py	94.11%	8 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main      #53       +/-   ##
===========================================
+ Coverage   72.97%   96.62%   +23.64%     
===========================================
  Files           8       12        +4     
  Lines         148      681      +533     
===========================================
+ Hits          108      658      +550     
+ Misses         40       23       -17     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.