List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.