Document production components and license notices

docs/policy/oss.md

@@ -192,6 +192,10 @@ copies, or changes the distribution of a relevant component. Check the selected
 and notices rather than assuming they are unchanged. Update affected entries,
 commit links, and texts; retain historical versions through Git.
 
+When the toolchain used for distributed binaries changes, check the Go runtime
+and standard-library entries against that toolchain's exact source revision,
+including any vendored packages incorporated into those binaries.
+
 Check affected statements, faithful standard-text copies, and link destinations
 as part of ordinary change review. For a future release tag, check intended file
 paths against the candidate source; the tag need not resolve remotely before