Make LICENSE-wheel reflect the bundled UI dependencies, plus two 0.43.0 RC0 fixes

[potiuk]

Follow-up to my -1 on the 0.43.0 RC0 vote thread, plus two smaller
things found while verifying that RC.

1. LICENSE-wheel did not reflect what the wheel contains

The wheel's only non-source content is the compiled tracking UI at
burr/tracking/server/build/assets/index-*.js. That bundle contains code
from 130 npm packages — MIT (115), ISC (9), Apache-2.0 (3),
BSD-3-Clause (2), PSF (1) — while LICENSE-wheel listed exactly one
third-party work (the deep-researcher MIT text). BSD-3-Clause in
particular requires the copyright notice be reproduced in redistributions.

This was raised as a non-blocking note on the 0.42.0 RC3 thread, and the
CRA → Vite migration (#793) made it worse by dropping the webpack-emitted
main.*.js.LICENSE.txt sidecar, so 0.43.0 ships less third-party license
information than 0.42.0 did.

Rather than hand-maintain the list — it drifts silently on every
dependency bump — this adds scripts/generate_wheel_license.py, which
derives it from the build itself: run a sourcemap build, read the
sourcemap's sources array to find every node_modules file actually
compiled into the bundle, resolve each to its owning package, and rewrite
everything below a marker line in LICENSE-wheel. Content above the
marker stays hand-maintained.

python scripts/generate_wheel_license.py           # regenerate
python scripts/generate_wheel_license.py --check   # fail if stale

NOTICE is deliberately unchanged: none of the 130 bundled packages
ships a NOTICE file, so there is no NOTICE content to carry over.

One thing worth a reviewer's eye: 28 of the packages ship no license file
at all (the micromark-* family, @react-aria/*, react-select,
@heroicons/react, heap). Those are listed with their package.json
license identifier and marked as such rather than silently omitted.

2. Release validation now catches this class of drift

RAT excludes burr/tracking/server/build/**, so the existing license step
never inspects the compiled UI — the only content the wheel adds over the
sdist. That is precisely where this gap hid. release-validation.yml now
runs generate_wheel_license.py --check after the artifact build (which
has already installed telemetry/ui/node_modules), so a UI dependency
bump that isn't reflected in LICENSE-wheel fails the PR.

3. pytest tests/ aborted collection without boto3

tests/integrations/test_bip0042_bedrock.py imported botocore at module
level, above the pytest.importorskip("boto3") guard. botocore ships with
boto3, so without the [bedrock] extra the import raised and pytest
reported a collection error rather than a skip — and a collection error
interrupts the whole run. pytest tests/, the command
scripts/README.md gives release voters, therefore executed zero
tests on a plain pip install -e ".[tests]".

CI doesn't catch it because the main test job passes
--ignore=tests/integrations/test_bip0042_bedrock.py.

Moving the import below the guard fixes it. Before: 1 error during collection. After: 1 skipped, and the rest of the suite runs.

4. GET /api/v0/version returned 500 on a clean install

The endpoint used pkg_resources. setuptools isn't a declared dependency,
isn't present in a venv created by modern tooling, and dropped
pkg_resources in 81.0, so the endpoint raised ModuleNotFoundError.
Switched to importlib.metadata; the fallback chain to the legacy burr
distribution and then "unknown" is unchanged. No UI component calls
this, but it is public API and is in the generated OpenAPI client.

Verification

• generate_wheel_license.py --check from a clean npm ci → 130 packages,
  up to date, exit 0 (reproduced from a different node_modules tree than
  the one used to generate the file)
• pytest tests/ without boto3 → 664 passed, 5 skipped (was: aborted)
• pytest tests/ with boto3 → 687 passed, 4 skipped
• GET /api/v0/version on a setuptools-free venv → 200 {"version":"0.43.0"}

Targets main. If this lands before an RC1 it will need cherry-picking
onto the release branch, since v0.43.0-incubating-RC0 was cut from
chore/release-0.43.0-rc0 rather than main.

🤖 Generated with Claude Code