Fork tooling: a build check and a rename pass in the strip, a notice check in CI

strip.py compiles the stripped tree, so a dual-licensed file that only
serves an Enterprise feature fails the import instead of the merge, as
v0.16.23's tests/src/directory/issuer.rs does. Upstream's tests of the
features the fork rebuilt are expected not to compile there and are listed
in build-check-known.txt; an error anywhere else fails the run. Checked
against both imports: v0.16.22 passes with its 16 expected errors, v0.16.23
fails on issuer.rs alone. Imports the strip leaves unused are reported.

It also renames the upstream name where clients, users or operators meet
it as an identifier, from tools/fork/renames.py: wire-protocol names, the
web interface's client id, store keys, configuration defaults and the
served schema. main is renamed with the same module, so a re-import
arrives purged and those lines don't conflict.

notice-check.py fails CI when an upstream file the fork changed, measured
against the upstream branch, lacks its AGPL 5(a) notice; --fix adds it.
It runs beside the name check in a renamed fork-checks job.

Also commits v0.16.23's strip report under docs/fork/strip-reports/, which
the import in #18 left out.

tools/fork/README.md

@@ -19,7 +19,23 @@ The report's Third-party code section lists upstream code under other
 licenses. Files marked **new** need their notice added to `THIRD-PARTY.md`
 at the repository root before the import is merged.
 
-It needs Python 3.12+ (for `tarfile`'s `data` filter) and git.
+It needs Python 3.12+ (for `tarfile`'s `data` filter), git and cargo.
+
+Two passes run after the strip:
+
+- **Renames.** The upstream name is replaced where it's an identifier
+  clients, users or operators meet: wire-protocol names, the web interface's
+  client id, store keys, configuration defaults and the served schema, as
+  `renames.py` lists them. `main` was renamed with the same module. A
+  re-import arrives purged, so those lines never conflict. Copyright notices
+  and prose are left alone. The report lists every substitution by file.
+- **Build check.** The stripped tree is compiled (`cargo check --workspace
+  --all-targets`) into `target/strip-check`, which stays warm between
+  imports. A file that survived the strip but calls code that didn't fails
+  the run; the report names it. Handle it in the merge into `main`, never on
+  `upstream`: `upstream` holds the strip's output and nothing else. Imports
+  the strip left unused are listed without failing. `--no-build-check`
+  skips the pass.
 
 ## name-check.py
 
@@ -37,6 +53,21 @@ Rename what it reports. If a string has to stay, such as a key-derivation
 context or a wire-protocol identifier, add its `--list` line to the allowlist
 under the reason it stays.
 
+## notice-check.py
+
+Fails when an upstream file the fork changed doesn't carry the AGPL 5(a)
+notice, `Modified by Coffey Labs in <year> for INBUXA.`, under upstream's
+license line. "Changed" means it differs from the `upstream` branch, so the
+list comes from the diff, not from memory. CI runs it beside the name check.
+
+```bash
+tools/fork/notice-check.py          # exit 1 on a missing notice
+tools/fork/notice-check.py --fix    # add it where it's missing
+```
+
+Run `--fix` after resolving an upstream merge: a conflict resolved by taking
+upstream's side can drop a notice the file had.
+
 ## record-compat.py
 
 Records what the `*_compat` tests compare against, from the Enterprise