release: restore ZUPT and harden source-only 5.2.2

NOTICE

@@ -1,22 +1,39 @@
-VaptVupt licensing notice
-=========================
+ZUPT notices
+============
 
-Copyright in first-party code remains with the copyright holders identified in
-file notices and repository history.
+Copyright remains with the holders identified by per-file notices and repository
+history.
 
-VaptVupt intentionally has two public source-license scopes:
+Public source-license scopes:
 
-- AGPL-3.0-or-later for application, GUI, SDK integration, and cryptographic
-  tool code identified by that SPDX expression;
-- GPL-3.0-or-later for the VaptVupt compression codec files identified by that
-  SPDX expression.
+- application, GUI, cryptographic tool, build and documentation code:
+  AGPL-3.0-or-later;
+- integrated VaptVupt compression codec files identified in LICENSE:
+  GPL-3.0-or-later.
+- xxHash-derived routines in `src/zupt_xxh.c` and `src/vv_xxh64.c`:
+  BSD-2-Clause in addition to their application/codec license.
+- pq-crystals/kyber-derived portions in `src/zupt_mlkem.c`:
+  CC0-1.0 in addition to the application license.
+- curve25519-donna-derived portions in `src/zupt_x25519.c`:
+  BSD-3-Clause in addition to the application license; Copyright 2008,
+  Google Inc.
+- the x86 BCJ state machine in `src/vv_bcj.c` is adapted from Igor Pavlov's
+  public-domain LZMA SDK source.
+- the SHA-NI compression path in `src/zupt_sha256_shani.c` is adapted from
+  Jeffrey Walton's public-domain SHA-Intrinsics reference.
 
-The unmodified public license texts are in LICENSE-AGPL-3.0 and the applicable
-GPL files/notices. The copyright holder may separately license controlled
-first-party rights through an individually executed commercial agreement.
-LICENSE-COMMERCIAL is an inquiry and scope notice, not such an agreement.
+The corresponding unmodified texts are LICENSE-AGPL-3.0,
+LICENSE-GPL-3.0, LICENSE-BSD-2-Clause, LICENSE-BSD-3-Clause, and
+LICENSE-CC0-1.0. Preserve THIRD-PARTY-NOTICES.md and all per-file SPDX and
+copyright notices when redistributing the source.
 
-No option relabels vendored or third-party material. Per-file notices and
-THIRD-PARTY-NOTICES.md control component scope.
+Published historical revisions contain MIT notices for some first-party
+application and GUI material. Those historical permissions remain attached to
+the exact material distributed under them; see the 5.2.2 licensing erratum in
+CHANGELOG.md. The current source scopes above do not revoke an earlier grant.
+
+LICENSE-COMMERCIAL describes a possible separately executed commercial
+agreement for controlled first-party rights. It grants no additional permission
+by itself and does not alter the public licenses.
 
 Commercial licensing contact: sac@securityops.co