vendor: use a pinned Graphify-Labs mirror of REA (no dependency on the upstream repo)

Per the decision to not depend on morluto/rea's repo availability: REA is now
sourced via a Graphify-Labs-controlled pinned mirror
(https://github.com/Graphify-Labs/rea, MIT, forked from morluto/rea @ 39275420,
tag reagraph-pin-6.7.0) rather than the upstream repo. REAgraph's source tree
still vendors NO REA code (REA is a Node program run as a separate process); the
mirror gives us a controlled, durable source of truth.

- examples/rea-docker/Dockerfile: pin rea-agents to 6.7.0 (ARG REA_VERSION), was
  @latest. Verified: builds, `rea-agents --version` = 6.7.0, and a real pull
  produces the expected 56-node graph.
- NOTICE: document the pinned Graphify-Labs mirror and MIT attribution; keep the
  non-affiliation / no-vendored-source statements (both still true).

A `reagraph setup-rea` that builds/pulls this image on demand is the next step.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

NOTICE

@@ -5,8 +5,15 @@ This product is an independent work. It is designed to interoperate with, but is
 NOT affiliated with, endorsed by, or derived from:
 
   - REA ("Reverse Engineer Anything"), https://github.com/morluto/rea (MIT).
-    "REA" and any related marks belong to their respective owners. REAgraph
-    consumes REA's output formats; it includes no REA source code.
+    "REA" and any related marks belong to their respective owners. The REAgraph
+    source tree itself includes no REA source code; it consumes REA's output
+    formats and runs REA as a separate process. For reproducibility and to avoid
+    depending on the upstream repository's availability, Graphify Labs maintains a
+    pinned mirror of REA at https://github.com/Graphify-Labs/rea (MIT, forked from
+    morluto/rea), which REAgraph's reference Docker image targets. REA is licensed
+    MIT; its copyright and license are preserved in that mirror. This mirror is an
+    unmodified pinned copy for reproducibility; it does not imply affiliation with
+    or endorsement by the upstream REA project.
   - graphify, https://github.com/Graphify-Labs/graphify (Apache-2.0). REAgraph
     writes graphs in graphify's node-link JSON format and delegates query/path/
     explain to graphify when it is installed.

examples/rea-docker/Dockerfile

@@ -3,13 +3,18 @@
 # Command Line Tools). This is the reproducible way to get a real JavaScript
 # Application Graph out of REA from a Mac host.
 #
+# REA is PINNED (rea-agents 6.7.0) for reproducibility. The source of truth is the
+# Graphify-Labs pinned mirror of REA -- https://github.com/Graphify-Labs/rea (MIT,
+# forked from morluto/rea @ 39275420) -- so this image does not depend on the
+# upstream repo staying available; see ../../NOTICE. Bump REA_VERSION to update.
+#
 # Build (from this directory):
 #   docker build -t reagraph-rea:latest .
 #
 # If your Docker lacks BuildKit/buildx, use the install+commit fallback instead:
 #   docker run --name rea_install node:24-slim \
 #     sh -c "apt-get update && apt-get install -y --no-install-recommends procps \
-#            && npm install -g rea-agents@latest"
+#            && npm install -g rea-agents@6.7.0"
 #   docker commit --change 'ENTRYPOINT ["rea-agents","--mcp"]' rea_install reagraph-rea:latest
 #   docker rm rea_install
 #
@@ -25,6 +30,10 @@
 
 FROM node:24-slim
 
+# Pinned REA (rea-agents) version. Kept in lockstep with the Graphify-Labs/rea
+# mirror; bump both together when updating.
+ARG REA_VERSION=6.7.0
+
 # procps gives REA a procps-compatible `ps`, which its process-ownership provider
 # requires before spawning the isolated JS analyzer worker (without it the
 # analysis fails with "spawn ps ENOENT"). node:24 satisfies REA's engine
@@ -32,7 +41,7 @@ FROM node:24-slim
 RUN apt-get update \
     && apt-get install -y --no-install-recommends procps \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g rea-agents@latest \
+    && npm install -g "rea-agents@${REA_VERSION}" \
     && npm cache clean --force
 
 # Start REA as an MCP stdio server. `docker run -i` keeps stdin open for the