docs: Record that upstream code in ui/ is not covered by the Stackable CLA

The vendored UI is a fork of the MPL-2.0-licensed Antora Default UI and
periodically ports upstream commits with their authorship preserved. Those
authors have not signed the Stackable CLA; their code is included under the
MPL-2.0 alone. Document this in ui/NOTICE and ui/README.adoc so provenance
is clear for anyone doing due diligence, and note that the CLA check on
port PRs (like this one) fails by design and needs an admin override.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lfrancke

ui/NOTICE

@@ -3,6 +3,12 @@ This UI is a fork of the Antora Default UI
 Mozilla Public License 2.0 (see LICENSE). Modifications are
 (c) Stackable GmbH and remain under MPL-2.0.
 
+Upstream commits are periodically ported into this fork with their
+original authorship preserved in the git history. The upstream authors
+are not signatories of the Stackable CLA; their code is included solely
+under the terms of the MPL-2.0. See README.adoc, section "Provenance
+and the Stackable CLA".
+
 This directory ships with (and its build output bundles) the following
 third-party components. Build-time minification strips embedded license
 header comments; this file preserves the attributions and is included

ui/README.adoc

@@ -92,6 +92,23 @@ Copyright (C) 2017-present OpenDevise Inc. and the Antora Project.
 Use of this software is granted under the terms of the https://www.mozilla.org/en-US/MPL/2.0/[Mozilla Public License Version 2.0] (MPL-2.0).
 See link:LICENSE[] to find the full license text.
 
+=== Provenance and the Stackable CLA
+
+This directory is a fork of the MPL-2.0-licensed https://gitlab.com/antora/antora-ui-default[Antora Default UI], and upstream commits are periodically ported into it (see link:UPSTREAM[]).
+Ported commits keep their original upstream authorship in the git history.
+
+The upstream authors have not signed the Stackable CLA and are not expected to.
+Their code is included solely under the terms of the MPL-2.0 (see link:LICENSE[]), not under the CLA.
+This is intentional and applies only to the contents of this directory.
+As a practical consequence, the CLA check fails on pull requests that port upstream commits; such PRs are merged with an administrative override after review.
+
+To list the authors of ported code:
+
+[source,bash]
+----
+git log --format='%an <%ae>' -- ui/ | sort -u
+----
+
 == Authors
 
 Development of Antora is led and sponsored by {url-opendevise}[OpenDevise Inc].