[miki3421]

Problem and change

Addresses #267 and the top-level source-distribution portion of #269.

The source LICENSE omitted upstream copyright notices for bundled JavaScript, while NOTICE contained inaccurate or unnecessary copies. Preserve the complete upstream license texts for the 30 listed package versions under licenses/javascript and reference them from LICENSE. This includes the MIT portion of sax and both Node.js/Joyent notices. Remove the corresponding JavaScript entries from NOTICE and exempt the upstream texts from ASF header rewriting.

The current 0.9.0 build downloads OpenWhisk and applies build/openwhisk-patch. The release metadata incorrectly described an unmodified vendored checkout and referenced files absent from a clean archive. Describe the actual shipped overlay, remove non-bundled Gradle/Spray entries, and exclude downloaded OpenWhisk checkouts and generated overlay archives even after a local build. Document this boundary in VERIFY.md. The pinned OpenWhisk reference and Gradle 6.9.1 build recipe remain unchanged.

The operator's separate inaccurate Gradle attribution is addressed in apache/openserverless-operator#147. This does not attempt the broader subdirectory license cleanup in #268.

Validation

• 30/30 package versions match existing lockfiles; 29 license texts are byte-identical to npm originals and xmlbuilder differs only by CRLF-to-LF normalization.
• Generated the source archive with the existing targz exclusion/transform arguments; all 30 license references resolve.
• Clean and deliberately contaminated staging trees produce identical contents: 1,531 files, including all 15 OpenWhisk overlay files. Generated checkout and intermediate fixtures are excluded.
• Every archived file matches the candidate. Git metadata is absent and the dangling top-level Spray license reference is removed.
• The local combined archive overlays only the companion operator LICENSE/NOTICE changes on the pinned submodule. No submodule pointers changed in this PR.
• git diff --check passes. Full compilation, image builds, RAT and license-eye were not rerun for these documentation/packaging changes.

The archive was a local unsigned verification artifact, not a release candidate.