packaging: fix license install path, document Flathub AI-policy risk

License files were installing to share/licenses/orbithub instead of
the path Flathub's own docs specify for this app
(share/licenses/org.darksingularity.OrbitHub, i.e. $FLATPAK_ID).
Also installs FreeRDP's and KodoTerm's bundled LICENSE files there
alongside OrbitHub's own, since previously only the latter was
installed at all.

docs/FLATHUB.md now documents two things found by checking Flathub's
current requirements directly rather than assuming prior packaging
work was sufficient: the vendored libvterm copy has no LICENSE file
at all (needs to come from upstream, not fabricated here), and
Flathub's Generative AI disclosure policy is a real, reviewer-
discretion acceptance risk for this project given its development
history — not something further packaging work resolves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/FLATHUB.md

@@ -27,6 +27,12 @@ submission is an external process with its own requirements.
 | Flathub manifest linter passes | One expected finding remains: `finish-args-ssh-filesystem-access` (see below) — everything else passes, including `only-arches` placement and runtime-version currency |
 | AppStream linter passes | Passing (both `appstreamcli validate` and `flatpak-builder-lint appstream`) |
 | Clean install works without host dependencies | Verified via local `.flatpak` bundle install and launch, on both KDE 6.10 and 6.11 runtimes |
+| Bundled-dependency license files installed per Flathub's `$FLATPAK_ID` convention | Partially done — path fixed from `share/licenses/orbithub` to the required `share/licenses/org.darksingularity.OrbitHub`; FreeRDP's and KodoTerm's `LICENSE` files now installed there too. **`libvterm`'s vendored copy has no `LICENSE`/`COPYING` file at all** — needs to be pulled from upstream and added as `third_party/libvterm/LICENSE` before submission (README claims MIT; not verified against an actual license file in-tree) |
+
+## ⚠️ Not yet addressed: Generative AI disclosure policy is a real acceptance risk, not a checklist item
+
+See the dedicated section below — unlike everything else on this page, this
+isn't something more packaging work resolves.
 
 ### `finish-args-ssh-filesystem-access` — expected, needs a submission-time justification
 
@@ -40,6 +46,32 @@ and configurations for connections"* — OrbitHub's case is the same pattern
 (read-write, specifically for `known_hosts` persistence and default identity
 file discovery). Include a similar justification in the submission PR.
 
+## ⚠️ Not yet addressed: Generative AI disclosure policy
+
+Flathub's [Generative AI policy](https://docs.flathub.org/docs/for-app-authors/requirements#generative-ai-policy)
+requires submitters to disclose "any AI-generated code, documentation,
+packaging, or other material" included in the app or its Flathub packaging,
+identifying "the affected parts and approximate extent." This is not a
+formality — it's evaluated at reviewer discretion, and reviewers may reject
+"based on the extent or role of generated material."
+
+OrbitHub's development has used Claude Code extensively — the app's C++
+source, this Flatpak packaging (manifest, metainfo, build scripts), and this
+tracking doc itself. Every commit in this repository carries a
+`Co-Authored-By: Claude Sonnet 5` trailer, which is itself effectively an
+existing disclosure trail. An honest submission disclosure needs to reflect
+that extent truthfully — not a token "some AI assistance was used" note.
+
+The same policy also prohibits AI tools from opening or automating the
+submission PR itself, or generating its commit messages, description, or
+review replies. **This means the actual submission PR — including its AI
+disclosure — has to be written and opened by a human, not drafted by
+Claude.** Not done, and not something this repo's tooling should attempt.
+
+This is a real acceptance risk that no amount of technical packaging work
+resolves — it's a policy/reviewer-discretion matter, separate from every
+other item on this page.
+
 ## Related finding (not a packaging blocker)
 
 During permission-narrowing research, RDP certificate verification was found
@@ -53,7 +85,8 @@ this work.
 ## Explicitly out of scope for this repo
 
 - Opening the actual submission PR against `github.com/flathub/flathub` —
-  requires the maintainer's GitHub identity, done outside this repo.
+  requires the maintainer's GitHub identity, done outside this repo, and per
+  the Generative AI policy above must be written by a human, not drafted here.
 - ARM64 build/testing — no hardware available.
 - Flathub's post-acceptance developer-verification step — done via
   Flathub's own website after acceptance, using DNS control of