Add dependency attribution and release notice guidance

docs/release.md

@@ -21,6 +21,17 @@ Choose an unused stable version under the release policy. Commit its note as
 `docs/releases/<version>.md`, beginning with a title such as
 `# Scriptorium v0.14.0` (an example, not an instruction to select that version).
 Include a concise summary and relevant compatibility impact or upgrade action.
+End the note with the following footer, replacing `<version>` in both absolute
+URLs with the selected version tag (for example, `v0.14.0`):
+
+```markdown
+[LICENSE](https://gitea.maximumdirect.net/eric/scriptorium/src/tag/<version>/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/scriptorium/src/tag/<version>/docs/oss/attribution.md)
+```
+
+Check that both URLs name files in the candidate tree at that tag. The tag may
+not resolve online until publication. The checked-in note is copied unchanged
+into the hosted release body by the existing workflow, so do not maintain a
+second footer there.
 Update affected canonical documentation with the change, and retire completed
 roadmap material when appropriate while preserving deferred work and links.
 No extra release-specific review signoff is required.