build(packaging): bundle ttyd prebuilt; record license-compliance notes (DEPS.md)

ttyd is the interactive-job launcher for worker TTY/DISPLAY modes: the
worker resolves it next to its own binary (inter_job_utils.c
readlink(/proc/self/exe) + /ttyd, /opt/xce/bin/ttyd fallback), so a
tarball without bin/ttyd silently loses -I/--tty on the target host.
The packager now picks it up from $BUILD_DIR/worker/ttyd first, then
/opt/xce/bin/ttyd, and warns loudly if neither exists.

NB it is NOT an upstream release: this is rshen's modified ttyd (version
string 1.7.7-eccebc6), and the binary we bundle today is that same
modified build. Source lands in-tree later and moves to a meson target;
the packager already prefers a build-dir copy for that day.

DEPS.md: document the ttyd situation (including the MIT-compatibility
audit needed before commercial distribution) and record the user-flagged
license note on bundling libhwloc/libedit/libtirpc -- fine for the
development/test rollout, needs a per-item license audit (bundled
LICENSE file at minimum) before commercial release.

Co-Authored-By: Claude Code <noreply@anthropic.com>

DEPS.md

@@ -49,6 +49,16 @@
 | unity | xbuild channel 源码 vendor（上游 ThrowTheSwitch/Unity） | 2.6.1 | 单元测试框架（libunity.a + unity/unity.h）；仅测试目标链接 |
 | packcc | 上游 arithy/packcc | >=2.2 | PEG 解析器生成器；构建工具而非链接库 |
 
+### 特殊：ttyd（预编译二进制，源码待入库）
+
+交互作业启动器（worker TTY/DISPLAY 模式经它拉起会话，`inter_job_utils.c` 按
+`/proc/self/exe` 同目录解析）。**不是官方 release**：是 rshen 修改过的 ttyd
+（版本串 `1.7.7-eccebc6`，与上游 1.7.7 不同），当前环境里已构建好的那一份也是
+这个修改版。现阶段打包脚本直接拾取该预编译静态二进制进 tarball
+（`bin/ttyd`）；源码后续提供后入库并转为 meson 目标构建，届时删除本条。
+**合规注意**：ttyd 上游是 MIT，但修改版引入的改动未审计，商业分发前需确认
+全部改动兼容 MIT 并保留版权声明。
+
 ### 特殊：libelogind → libsystemd
 
 worker 的 systemd transient unit 管理（`sd_bus_*`，263 处调用）目前链 nix 的 elogind 255.5。
@@ -79,3 +89,10 @@ LD_LIBRARY_PATH 泄漏会导致系统工具崩溃（t2/t3 的 ls/head segfault
 - **永不 bundle**：libc/libm/libpthread/libdl/librt（glibc）、libsystemd（按目标发行版）
 - 判定方法：对每个产物 `ldd`，凡路径不在 {/lib, /usr/lib, /lib64} 的（即 wrap 构建产物）
   一律复制进 `lib/`，二进制设 `$ORIGIN/../lib` RPATH。
+
+> **license 合规备忘（2026-10-21，用户提出）**：bundle 清单里 libhwloc 是 BSD-3，
+> 但它静态/动态再分发时需保留版权与许可声明（tarball 目前未附第三方 license
+> 文本）；libedit 是 BSD（特意选它替代 GPL readline）；libtirpc 历史上是
+> BSD/Sun RPC 混合许可。**开发测试阶段沿用现分发策略没问题；商业环境发布前
+> 须逐项做 license 审计**（至少：附第三方 LICENSE 汇总文件、确认 hwloc 各传递
+> 依赖许可）。记录在案，暂不阻塞当前 rollout。

src/tools/xce-package.sh

@@ -53,6 +53,25 @@ if [ -d "$BUILD_DIR/xceadmin/.venv" ]; then
 fi
 # static worker fallback for hosts without systemd --include cgroup support
 [ -f "$BUILD_DIR"/worker/xcecd_virtual ] && install -m 755 "$BUILD_DIR"/worker/xcecd_virtual "$STAGING/bin/"
+# ttyd: interactive-job launcher (TTY/DISPLAY modes). The worker resolves it
+# NEXT TO ITS OWN BINARY (inter_job_utils.c readlink(/proc/self/exe) + /ttyd)
+# with /opt/xce/bin/ttyd as fallback -- so shipping bin/ttyd in the tarball
+# is what actually runs on the target.
+# NB: NOT an upstream release. This is rshen's MODIFIED ttyd (version string
+# 1.7.7-eccebc6; the official 1.7.7 differs) and the binary below is that
+# same modified build. Source lands in-tree later and moves to a proper
+# meson target then; until then we carry the prebuilt static binary.
+TTYD_SRC=""
+for cand in "$BUILD_DIR/worker/ttyd" /opt/xce/bin/ttyd; do
+    if [ -x "$cand" ]; then TTYD_SRC="$cand"; break; fi
+done
+if [ -n "$TTYD_SRC" ]; then
+    install -m 755 "$TTYD_SRC" "$STAGING/bin/ttyd"
+    echo "=== ttyd: bundled prebuilt from $TTYD_SRC (modified build, source pending) ==="
+else
+    echo "WARNING: ttyd not found (looked in $BUILD_DIR/worker/ttyd, /opt/xce/bin/ttyd);" >&2
+    echo "         interactive jobs (-I/--tty) will fail on the target host." >&2
+fi
 
 # --- bundled shared libraries ---
 # Two collection rules (DEPS.md 运行期 bundle 规则):