fix: accept bundled native runtime licenses

TODO.md

@@ -1,5 +1,12 @@
 # Production Readiness TODO
 
+- [ ] Accept producer-declared native runtime license material in verified
+  product bundles so v0.76.1 CUDA packaging can complete without weakening the
+  existing checksum, entry-type, tree-digest, or single-runtime checks.
+  QA: focused archive fixtures accept `licenses/NVIDIA-CUDA-LICENSE.txt`, the
+  full TypeScript suite passes, matrix validation remains green, actionlint
+  passes, and a protected v0.76.1 packaging rerun completes every required job.
+
 - [x] Preserve NVIDIA's installed NCCL version when preparing CUDA dependencies.
   QA: reproduce the held-package failure with the exact ARM64 CUDA 12 base;
   verify the fixed installer preserves NCCL, tests cover absent and installed

scripts/upstream-archive.ts

@@ -67,7 +67,7 @@ export function validateArchiveEntries(entries: string[]): void {
     if (!match) throw new Error(`unexpected product archive entry: ${path}`);
     const [, runtimeId, relative] = match;
     if (!runtimeIdPattern.test(runtimeId)) throw new Error(`unsafe native runtime id: ${runtimeId}`);
-    if (relative !== "manifest.json" && relative !== "README.md" && !relative.startsWith("lib/") && !relative.startsWith("tools/")) {
+    if (relative !== "manifest.json" && relative !== "README.md" && !relative.startsWith("lib/") && !relative.startsWith("licenses/") && !relative.startsWith("tools/")) {
       throw new Error(`unexpected native runtime entry: ${path}`);
     }
     runtimeIds.add(runtimeId);

tests/upstream-archive.test.ts

@@ -123,6 +123,18 @@ test("rejects unsafe runtime IDs before accepting runtime paths", () => {
   ]), /runtime id/);
 });
 
+test("accepts bundled native runtime license material", () => {
+  assert.doesNotThrow(() => validateArchiveEntries([
+    "mesh-bundle/mesh-llm",
+    "mesh-bundle/product-manifest.json",
+    "mesh-bundle/host-imports.json",
+    "mesh-bundle/native-runtimes/linux-cuda/manifest.json",
+    "mesh-bundle/native-runtimes/linux-cuda/README.md",
+    "mesh-bundle/native-runtimes/linux-cuda/lib/libllama.so",
+    "mesh-bundle/native-runtimes/linux-cuda/licenses/NVIDIA-CUDA-LICENSE.txt",
+  ]));
+});
+
 test("keeps sha256Tree digest compatible with the original tree format", async (t) => {
   const data = await fixture(t);
   const runtime = resolve(data.directory, "stage/mesh-bundle/native-runtimes/linux-cpu");