Fork tooling: a build check and a rename pass in the strip, a notice check in CI

strip.py compiles the stripped tree, so a dual-licensed file that only
serves an Enterprise feature fails the import instead of the merge, as
v0.16.23's tests/src/directory/issuer.rs does. Upstream's tests of the
features the fork rebuilt are expected not to compile there and are listed
in build-check-known.txt; an error anywhere else fails the run. Checked
against both imports: v0.16.22 passes with its 16 expected errors, v0.16.23
fails on issuer.rs alone. Imports the strip leaves unused are reported.

It also renames the upstream name where clients, users or operators meet
it as an identifier, from tools/fork/renames.py: wire-protocol names, the
web interface's client id, store keys, configuration defaults and the
served schema. main is renamed with the same module, so a re-import
arrives purged and those lines don't conflict.

notice-check.py fails CI when an upstream file the fork changed, measured
against the upstream branch, lacks its AGPL 5(a) notice; --fix adds it.
It runs beside the name check in a renamed fork-checks job.

Also commits v0.16.23's strip report under docs/fork/strip-reports/, which
the import in #18 left out.

docs/spec/SPEC.md

@@ -91,7 +91,22 @@ The wrapper is `tools/fork/strip.py`. Beyond `ossify.py` it:
   was ported or adapted from elsewhere. Any file `THIRD-PARTY.md` doesn't
   cover yet is flagged as new. It's reported, not a failure: the notice goes
   into `THIRD-PARTY.md` in the merge that brings the release in, since the
-  fork redistributes that code and its license requires the notice.
+  fork redistributes that code and its license requires the notice;
+- renames the upstream name where it's an identifier clients, users or
+  operators meet (wire-protocol names, the web interface's client id, store
+  keys; §2.4), with the same substitutions `main`
+  carries, so those lines arrive purged and never conflict (added
+  2026-09-22);
+- compiles the stripped tree. A dual-licensed file that only serves an
+  Enterprise feature survives the strip but can't build without it:
+  v0.16.23's `tests/src/directory/issuer.rs` was the first. The build check
+  fails the run on it, and the merge into `main` drops or reworks it (added
+  2026-09-22).
+
+Two checks in CI cover what a merge can bring in without a conflict:
+`tools/fork/name-check.py` (the upstream name in a new string literal) and
+`tools/fork/notice-check.py` (a changed upstream file without its AGPL 5(a)
+notice).
 
 ### 2.2a Snapshots, not a git fork