chore: serve.py vendor allowlist + Dockerfile per-file COPY + NOTICE attributions

Part of the batch-1 console uniqueness + sovereign-fonts rebuild. Every batch tab gets a distinct real-data viz; 7 libs vendored locally (zero CDN); Google Fonts removed in favor of self-hosted @font-face. Honesty: locked-5 {F1,F11,F12,F18,F19} kernel-verified; experimental waves CI-green @958c09f9; Lambda=Conjecture 1; conformal=W5-3 (NOT Hoeffding).

Signed-off-by: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>

Dockerfile

@@ -179,6 +179,15 @@ COPY static-vendor/cytoscape.min.js ./static-vendor/cytoscape.min.js
 COPY static-vendor/d3.min.js ./static-vendor/d3.min.js
 COPY static-vendor/katex.min.js ./static-vendor/katex.min.js
 COPY static-vendor/katex.min.css ./static-vendor/katex.min.css
+# Batch-1 uniqueness rebuild (2026-06-06): additional vendored graph-viz libs
+# (MIT/ISC/BSD; NOTICE updated). Per-file COPY (this Dockerfile uses no COPY . .).
+COPY static-vendor/dagre.min.js ./static-vendor/dagre.min.js
+COPY static-vendor/cytoscape-dagre.js ./static-vendor/cytoscape-dagre.js
+COPY static-vendor/d3-sankey.min.js ./static-vendor/d3-sankey.min.js
+COPY static-vendor/ngraph.graph.min.js ./static-vendor/ngraph.graph.min.js
+COPY static-vendor/ngraph.path.min.js ./static-vendor/ngraph.path.min.js
+COPY static-vendor/ngraph.forcelayout.min.js ./static-vendor/ngraph.forcelayout.min.js
+COPY static-vendor/panzoom.min.js ./static-vendor/panzoom.min.js
 COPY _vendor_blobs.py ./_vendor_blobs.py
 
 # ADDITIVE (V4 Fleet Panel + /api/health fix, 2026-06-02, Dev2 Inti):

NOTICE

@@ -37,6 +37,26 @@ code; the libraries themselves are used unmodified under their own licenses.
   Cytoscape.js                       — (c) The Cytoscape Consortium      — MIT
     https://github.com/cytoscape/cytoscape.js
 
+  Batch-1 uniqueness rebuild (2026-06-06) — additional vendored graph-viz libs
+  (self-hosted at /vendor/, ZERO runtime CDN):
+  dagre                              — (c) Chris Pettitt                  — MIT
+    https://github.com/dagrejs/dagre
+  cytoscape-dagre                    — (c) Cytoscape Consortium           — MIT
+    https://github.com/cytoscape/cytoscape.js-dagre
+  d3-sankey                          — (c) Mike Bostock                   — ISC
+    https://github.com/d3/d3-sankey
+  ngraph.graph                       — (c) Andrei Kashcha (anvaka)        — BSD-3-Clause
+    https://github.com/anvaka/ngraph.graph
+  ngraph.path                        — (c) Andrei Kashcha (anvaka)        — MIT
+    https://github.com/anvaka/ngraph.path
+  ngraph.forcelayout                 — (c) Andrei Kashcha (anvaka)        — MIT
+    https://github.com/anvaka/ngraph.forcelayout
+  panzoom                            — (c) Andrei Kashcha (anvaka)        — MIT
+    https://github.com/anvaka/panzoom
+  (knowledge tab GPU point-graph + trustspace GLSL trust-gradient field are
+   our own WebGL code rendered via the already-vendored THREE in 3d-force-graph,
+   following the anvaka ngraph.pixel / fieldplay PATTERNS — no third-party code copied.)
+
 Vendored fonts (self-hosted locally for zero-runtime-CDN sovereignty; served
 from /vendor/fonts/*.woff2, shipped as base64 in _vendor_blobs.py — NO Google
 Fonts CDN at runtime):

serve.py

@@ -3656,6 +3656,15 @@ try:
         "d3.min.js": _VENDOR_JS_CT,
         "katex.min.js": _VENDOR_JS_CT,
         "katex.min.css": _VENDOR_CSS_CT,
+        # Batch-1 uniqueness rebuild (2026-06-06): additional vendored graph-viz
+        # libs, all MIT/ISC/BSD (NOTICE updated). Self-hosted, ZERO CDN.
+        "dagre.min.js": _VENDOR_JS_CT,                  # dagre 0.8.5 (MIT)
+        "cytoscape-dagre.js": _VENDOR_JS_CT,            # cytoscape-dagre 2.5.0 (MIT)
+        "d3-sankey.min.js": _VENDOR_JS_CT,             # d3-sankey 0.12.3 (ISC)
+        "ngraph.graph.min.js": _VENDOR_JS_CT,          # ngraph.graph 20.0.1 (BSD-3, anvaka)
+        "ngraph.path.min.js": _VENDOR_JS_CT,           # ngraph.path 1.5.0 (MIT, anvaka)
+        "ngraph.forcelayout.min.js": _VENDOR_JS_CT,    # ngraph.forcelayout 3.3.1 (MIT, anvaka)
+        "panzoom.min.js": _VENDOR_JS_CT,               # panzoom 9.4.3 (MIT, anvaka)
     }
 
     # NOTE on route ORDER: literal paths (/vendor/earth-night.jpg, /vendor/fonts/*)