build(dwg): ship the parser wasm built on unmodified acadrust 0.6.5

The shipped wasm was built from a vendored acadrust 0.4.1 carrying local
changes in two files (read_mesh array bounds, OLE2FRAME corner decoding),
and the published read_mesh patch did not even apply to the pristine
crate, so the notice could not reproduce the source compiled into the
wasm (MPL-2.0 3.2). acadrust 0.6.5 already does both on its own: the
road-surface MESH and the C0060203 OLE2FRAME come out identical to the
patched build, so the parser now uses the crate exactly as crates.io
serves it.

The notices name 0.6.5, its upstream commit and the crate SHA-256 (equal
to the Cargo.lock checksum the build used), the stale patch file is
removed, and the page links to the crate source instead.

Verified on 22 samples, loading each with the old and the new wasm in
Chrome: all load, 17 render pixel-identical, and the 5 that differ are
0.4.1 misreads that 0.6.5 corrects. The wrapper changes this needed live
in hmwebviewer rust/dwg-wasm (branch chore/acadrust-0.6.5).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

THIRD-PARTY-NOTICES.md

@@ -10,43 +10,34 @@ Served copies of the license texts live under
 
 ---
 
-## acadrust 0.4.1 — Mozilla Public License 2.0 — **MODIFIED**
+## acadrust 0.6.5 — Mozilla Public License 2.0 — unmodified
 
 | | |
 |---|---|
 | Component | `acadrust` (DWG/DXF parser, Rust) |
-| Version | 0.4.1 |
+| Version | 0.6.5 |
 | License | MPL-2.0 — full text: [`public/licenses/acadrust-MPL-2.0.txt`](./public/licenses/acadrust-MPL-2.0.txt) (`/licenses/acadrust-MPL-2.0.txt`) |
-| Upstream | https://github.com/hakanaktt/acadrust · https://crates.io/crates/acadrust/0.4.1 |
-| Upstream commit | `f249c2f816acf36ee51cd5533716bdd443c2517e` (from the crate's `.cargo_vcs_info.json`) |
+| Upstream | https://github.com/hakanaktt/acadrust · https://crates.io/crates/acadrust/0.6.5 |
+| Upstream commit | `289a616da6c68518218594aa80802cbe7fa71309` (from the crate's `.cargo_vcs_info.json`) |
+| Crate SHA-256 | `5eaa72520f70eb6f7f09b06f44e1ed0d8fad5fa743364f2c3715c30df962ec7c` (the `Cargo.lock` checksum the build used) |
 | Author | Hakan AK |
 | Shipped as | compiled into `assets/acadrust_dwg_bg-*.wasm` (Executable Form) |
 
-**This copy is modified.** One file differs from the published crate:
-
-```
-src/io/dwg/dwg_stream_readers/object_reader/entities.rs   (read_mesh array-count bounds)
-```
-
-The modification bounds `read_mesh`'s array counts by the bits remaining in the
-object stream instead of the blanket 100 000-item guard, which truncated and
-thereby corrupted large SubD meshes.
+**This copy is not modified.** The `.wasm` is built from the published crate
+exactly as crates.io serves it.
 
 ### How to obtain the Source Code Form (MPL-2.0 §3.2)
 
-1. Get the unmodified crate source — `cargo vendor`, or
-   `https://crates.io/api/v1/crates/acadrust/0.4.1/download`, or the upstream
-   commit above.
-2. Apply [`public/licenses/acadrust-0.4.1-read_mesh.patch`](./public/licenses/acadrust-0.4.1-read_mesh.patch)
-   (`/licenses/acadrust-0.4.1-read_mesh.patch` on the deployed site):
+Download the crate, which is the complete source compiled into the shipped
+`.wasm`:
 
-   ```bash
-   tar xf acadrust-0.4.1.crate && cd acadrust-0.4.1
-   patch -p1 < acadrust-0.4.1-read_mesh.patch
-   ```
+```bash
+curl -L -o acadrust-0.6.5.crate https://static.crates.io/crates/acadrust/acadrust-0.6.5.crate
+tar xzf acadrust-0.6.5.crate
+```
 
-The result is the exact Source Code Form of the acadrust code compiled into the
-shipped `.wasm`. Both the original and the modified file remain under MPL-2.0.
+or `cargo vendor` in any project that depends on `acadrust = "=0.6.5"`, or the
+upstream commit above.
 
 ---