Add dependency attribution and release notice guidance

docs/oss/attribution.md

@@ -0,0 +1,33 @@
+# Open-Source Attribution
+
+Scriptorium's own terms are in the repository [LICENSE](../../LICENSE).
+Dependency license texts include the [GNU GPL v3](licenses/GPL-3.0.txt),
+[GNU LGPL v3](licenses/LGPL-3.0.txt), [Apache 2.0](licenses/Apache-2.0.txt),
+[BSD 3-Clause](licenses/BSD-3-Clause.txt), and the upstream
+[yaml.v3 license](licenses/yaml.v3-LICENSE.txt) and
+[notice](licenses/yaml.v3-NOTICE.txt). Versions are recorded in `go.mod` and
+`go.sum`; component source links below identify the selected releases.
+
+## Promptkit
+
+Copyright (C) 2026 Eric Rakestraw
+
+[SPDX-License-Identifier: LGPL-3.0-or-later](licenses/LGPL-3.0.txt)
+
+[Source: Promptkit v0.11.0](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0)
+
+## Backend Catalogs
+
+The selected OpenRouter and Rakestrawhome catalog modules carry the GNU LGPL v3
+and its incorporated GPL v3. Their source repositories identify the profile
+assets as originating in Promptkit and intentionally relicensed for the catalog
+modules.
+
+- [OpenRouter catalog v2.20260922.1](https://gitea.maximumdirect.net/eric/promptkit-backend-openrouter/src/tag/v2.20260922.1) — [LGPL v3](licenses/LGPL-3.0.txt).
+- [Rakestrawhome catalog v2.20260922.0](https://gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/src/tag/v2.20260922.0) — [LGPL v3](licenses/LGPL-3.0.txt).
+
+## Other Go Dependencies
+
+- [jsonschema/v6 v6.0.2](https://github.com/santhosh-tekuri/jsonschema/tree/v6.0.2) — [Apache 2.0](licenses/Apache-2.0.txt).
+- [golang.org/x/text v0.14.0](https://github.com/golang/text/tree/v0.14.0) — [BSD 3-Clause](licenses/BSD-3-Clause.txt); Copyright (c) 2009 The Go Authors. All rights reserved.
+- [gopkg.in/yaml.v3 v3.0.1](https://github.com/go-yaml/yaml/tree/v3.0.1) — the upstream [MIT and Apache license notice](licenses/yaml.v3-LICENSE.txt) and separate [NOTICE](licenses/yaml.v3-NOTICE.txt).