refresh-third-party-inventory

Fix a Dependabot PR's red "Third-party licenses current" check — checks out the PR branch, runs make refresh-third-party-inventory, shows the diff, and pauses for explicit confirmation before committing (DCO sign-off) and pushing. Never pushes unprompted. Triggers on "fix the licenses check on this PR", "the Dependabot PR is red on third-party licenses", or a pointer to a failing Third-party licenses current run.