docs: keep notices fresh at commit time instead of a new CI gate

Regenerate THIRD_PARTY_NOTICES.md from a pre-commit job whenever a
manifest, lock file, vendor manifest, or pyproject is staged, and assert
the committed bytes inside the generator spec the test lane already runs.
Drops the separate doc-sync gate: no extra CI process, and a dependency
edit no longer bounces back from CI to rerun a generator.

scripts/gen-third-party-notices.ts

@@ -283,8 +283,11 @@ function renderNpmTable(deps: ExternalDep[]): string {
   return lines.join('\n')
 }
 
-/** Render the complete notices document. */
-function render(): string {
+/**
+ * Render the complete notices document.
+ * @returns the exact bytes `THIRD_PARTY_NOTICES.md` must hold.
+ */
+export function render(): string {
   verifyBuildTimePins()
   const npm = collectNpmDeps()
   const runtimeDeps = npm.filter(dep => dep.runtime)