Record the dual-licence elections continuum-proxy was relying on

Rule one at the top of this document says to record an election so it is not
re-litigated, and three dependencies in continuum-proxy had never had theirs
written down. All three already passed `cargo deny check licenses`; the point
is that a grep for "GPL" turns up an answer instead of an argument.

- `unescaper` 0.1.10 is `MIT OR GPL-3.0-only`, reached through
  tokio-serial -> serialport, so it is genuinely in the Linux build.
- `r-efi` 6.0.0 offers LGPL-2.1-or-later as one of three options, but only
  compiles for UEFI targets - noted because the next person to grep will
  find it and should not have to work that out again.
- `serialport` 4.10.0 is MPL-2.0, which the table allows because the
  copyleft is per-file. That holds only while we do not edit its files, so
  the condition is now written next to the permission.

Also records the eight crates added to continuum-proxy on 2026-10-15 for
reading `.3mf` archives, and why the zip feature set is deflate-only: the
other codec features pull in bzip2, lzma/xz and zstd bindings, each another
licence to check for no benefit.

Verified from `cargo metadata` and `cargo tree --invert`, not from memory.

docs/LICENSES.md

@@ -141,6 +141,39 @@ A `node_modules` walk turns up packages named `baz`, `browser_field`,
 field. These are test fixtures *inside* other packages, not dependencies.
 Ignore them.
 
+## Audit, 2026-10-15 - continuum-proxy dual-licence elections
+
+Found while adding a zip reader to `continuum-proxy` (see below). All three
+were already in the tree, all three pass `cargo deny check licenses`, and
+none had its election recorded - which rule one at the top of this document
+says to do, so that a `grep` for "GPL" does not restart the argument.
+Verified from `cargo metadata`, not from memory.
+
+**`unescaper` 0.1.10 - `MIT OR GPL-3.0-only`, we elect MIT.** Reached via
+`tokio-serial` -> `serialport` -> `unescaper`, so it is in the Linux build.
+The MIT half is ours to take.
+
+**`r-efi` 6.0.0 - `MIT OR Apache-2.0 OR LGPL-2.1-or-later`, we elect MIT or
+Apache-2.0.** Reached via `native-tls` -> `tempfile` -> `getrandom`, but only
+on UEFI targets: it is not compiled for any platform we ship. The LGPL option
+would be the problem one if it ever were, and electing around it is free.
+
+**`serialport` 4.10.0 - MPL-2.0, allowed with a condition.** The table above
+permits MPL-2.0 because its copyleft is per-file, which holds only while we
+do not edit the dependency's own files. We do not and should not: if
+`serialport` ever needs a patch, vendor the change as a fork with its own
+notice, or wrap it, rather than editing files in place.
+
+**New in `continuum-proxy` on 2026-10-15, all clear:** `zip` 9.0.3 (MIT),
+`flate2` 1.1.10, `crc32fast` 1.5.2, `typed-path` 0.12.3 (all
+`MIT OR Apache-2.0`), `miniz_oxide` 0.9.1 (`MIT OR Zlib OR Apache-2.0`),
+`adler2` 2.0.1 (`0BSD OR MIT OR Apache-2.0`), `simd-adler32` 0.3.10 (MIT),
+`zlib-rs` 0.6.8 (Zlib). Added for reading `.3mf` project archives. The
+feature set is deliberately `deflate-flate2` only - `zip`'s other codec
+features pull in bzip2, lzma/xz and zstd bindings, none of which are needed
+and each of which is another licence to check. Confirmed none of them entered
+the graph.
+
 ## When adding a dependency
 
 1. Check the licence against the table above **before** writing code against