Keep LICENSE as plain MIT so GitHub detects it; move third-party notices out

GitHub read the licence as 'Other' because the MIT text was followed by a long
third-party appendix. The appendix now lives in docs/THIRD-PARTY-NOTICES.md
(expanded with the full installed-licence table and an explicit 'not included'
section) and LICENSE is the canonical MIT text only. README points at it.

LICENSE

@@ -19,23 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
----
-
-This licence covers only the files in this repository (Dockerfile, compose
-files, scripts, documentation). The image it builds installs third-party
-software that keeps its own licence and terms, including:
-
-* Ghidra (Apache-2.0), OpenJDK (GPL-2.0-with-classpath-exception), Node.js (MIT),
-  REA rea-agents (MIT), Qt6 (LGPL-3.0), Hopper (commercial, public demo
-  redistributed here as downloaded from the vendor), WABT (Apache-2.0),
-  Apktool (Apache-2.0), jadx-headless-mcp (Apache-2.0), .NET SDK (MIT),
-  ILSpy/ilspycmd (MIT), pwntools (MIT), pyelftools/public-domain, Unicorn
-  (GPL-2.0), pwndbg (MIT), unblob (MIT), mitmproxy (MIT), Wireshark/tshark
-  (GPL-2.0), sigrok-cli (GPL-3.0), Android platform-tools (Apache-2.0),
-  binwalk (MIT), wine (LGPL-2.1), Frida (wxWindows/LGPL), supergateway (MIT),
-  uv (Apache-2.0/MIT), Google Chrome (proprietary, redistributed as downloaded).
-
-IDA Pro/IDA Home/IDA Free and JEB are **not** included and must be obtained and
-licensed separately by the operator. Redistributing IDA is not permitted by its
-licence; keep any image that contains it private.

README.md

@@ -279,5 +279,8 @@ catalog, refused ELF machine, unlicensed IDA/JEB).
 
 The files in this repository are yours to use under the MIT licence (see
 `LICENSE`). Every third-party tool inside the image keeps its own licence and
-terms; two of them (IDA, JEB) are commercial and must be licensed by you, and a
-third (Hopper) is commercial with a redistributable demo. REA itself is MIT.
+terms — the full list, plus the components that are deliberately absent, is in
+[`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md). Two of them (IDA,
+JEB) are commercial and must be licensed by you; a third (Hopper) is commercial
+with a redistributable demo, and only that demo is ever downloaded here. REA
+itself is MIT.

docs/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,50 @@
+# Third-party notices
+
+This repository is MIT-licensed (see [`LICENSE`](../LICENSE)) and covers the
+files here: the Dockerfile, compose files, scripts and documentation.
+
+The **image it builds** installs a lot of third-party software, each of which
+keeps its own licence and terms. That installed set is:
+
+| Component | Licence |
+| --- | --- |
+| Ghidra | Apache-2.0 |
+| OpenJDK 21 | GPL-2.0-with-classpath-exception |
+| Node.js | MIT |
+| REA (`rea-agents`) | MIT |
+| Qt6 runtime (Hopper's dependency) | LGPL-3.0 |
+| Hopper (Linux demo package) | commercial; the **public demo** build is redistributed here exactly as downloaded from the vendor |
+| WABT | Apache-2.0 |
+| Apktool | Apache-2.0 |
+| jadx-headless-mcp | Apache-2.0 |
+| .NET SDK 8 | MIT |
+| ILSpy / `ilspycmd` | MIT |
+| pwntools | MIT |
+| pyelftools | public domain |
+| Unicorn | GPL-2.0 |
+| pwndbg | MIT |
+| unblob | MIT |
+| mitmproxy | MIT |
+| Wireshark / `tshark` and `capinfos` | GPL-2.0 |
+| sigrok-cli / libsigrokdecode | GPL-3.0 |
+| Android platform-tools (`adb`) | Apache-2.0 |
+| binwalk | MIT |
+| wine | LGPL-2.1 |
+| Frida | wxWindows Library Licence (LGPL-2.1-based) |
+| supergateway | MIT |
+| uv | Apache-2.0 / MIT |
+| Google Chrome (stable) | proprietary; packaged `.deb` redistributed as downloaded from Google |
+| e2fsprogs, dosfstools, mtools, device-tree-compiler, squashfs-tools, cpio, sleuthkit, 7-Zip, cabextract, yara, upx, nasm, qemu-user-static, cross toolchains, X11/Qt/font libraries | the licence of each Debian/Ubuntu package (predominantly GPL/LGPL/BSD/MIT — see `/usr/share/doc/<package>/copyright` inside the image) |
+
+## Not included, on purpose
+
+**IDA Pro / IDA Home / IDA Free** and **JEB** are *not* included in any image
+this project builds. They must be obtained and licensed separately by the
+operator, and redistributing them is not permitted by their licences — keep any
+image that contains your own IDA or JEB install private. See
+[`BYO-LICENSES.md`](BYO-LICENSES.md) and [`ida-variants.md`](ida-variants.md).
+
+A **licensed Hopper** package is likewise yours to supply: the repo only ever
+downloads the vendor's public demo build, and a licensed `.deb` you drop into
+`vendor/` (never committed — see `.gitignore`) is your responsibility to keep
+private.