Ship libccd's notice, and keep the rectangle helpers on purpose

libccd is compiled into libakgl.so and is BSD-3-Clause, so the notice has to
travel with the binary form. cmake --install now puts BSD-LICENSE at
share/doc/akgl/BSD-LICENSE.libccd, and the README says which dependency is in
that position and which are not -- everything else in deps/ is either a separate
shared object carrying its own notice, a header, or compiled into nothing.

The plan's last step was to delete akgl_rectangle_points,
akgl_collide_point_rectangle and akgl_collide_rectangles. That step is not taken,
and TODO.md carries the reasoning rather than leaving it to be rediscovered:
akgl_collide_rectangles has two correct callers in the sidescroller asking a
game-level overlap question that wants a bool, and it was fixed two commits into
this same series -- deleting it now would be a strange thing to do to a caller.
The other two are the weak case and are named as the candidates if a 0.9.0 wants
to trim.

akgl_RectanglePoints' comment still claimed akgl_collide_rectangles works corner
by corner, which stopped being true when the cross case was fixed. Corrected in
place, with the cross case named so the note explains why the shape changed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KzBDV2fqgnUAcqCKqKvc71
Co-Authored-By: Andrew Kesterson <andrew@aklabs.net>

README.md

@@ -199,3 +199,21 @@ scripts/memcheck.sh -LE perf            # skip the benchmarks
 The run forces `SDL_VIDEO_DRIVER=dummy`, `SDL_RENDER_DRIVER=software` and `SDL_AUDIO_DRIVER=dummy` so the vendor GPU stack is never loaded — that removes thousands of unfixable findings inside the driver without suppressing anything. Definite leaks, invalid accesses and uninitialised reads are counted and set the exit status; "still reachable" is not, because that is what SDL and FreeType keep for the process lifetime. Suppressions for genuine third-party findings are in `scripts/valgrind.supp`.
 
 What it found the first time it ran is in `TODO.md` under **Memory checking**.
+
+## What is compiled in, and the notice it carries
+
+**[libccd](https://github.com/danfis/libccd) is compiled into `libakgl.so`.** It is the
+collision narrowphase -- GJK, EPA and MPR, the same code vendored in ODE, FCL and Bullet --
+and it is **BSD-3-Clause**. Its licence is `deps/libccd/BSD-LICENSE`, and `cmake --install`
+puts a copy at `share/doc/akgl/BSD-LICENSE.libccd`. If you redistribute a binary built from
+this tree, that notice has to travel with it.
+
+It is the only dependency in that position. SDL3, SDL3_image, SDL3_mixer, SDL3_ttf, jansson,
+libakerror and libakstdlib are all linked as separate shared objects and carry their own
+notices; `deps/semver` is a single header, MIT, installed alongside ours; and `deps/tg` is
+vendored but **compiled into nothing** -- see `TODO.md`, "tg is vendored and has no
+consumer".
+
+libccd is given a static arena rather than the allocator it ships with, so "libakgl does not
+call `malloc` at runtime" stays literally true with it linked in. That is
+`src/collision_arena.c`, and [Chapter 15](docs/15-collision.md) explains why.