docs: record the avatar characters in the third-party notices

avatar2.glb and avatar3.glb are Adobe Mixamo exports (the Beta and Remy
characters): both carry the mixamorig: skeleton, a mixamo.com animation track,
and Mixamo mesh and texture names. List them alongside xbot.glb so the existing
Mixamo posture covers every committed character, and sync package-lock.json with
the 0.4.3 workspace versions.

Author: a-baran-orhan

docs/legal/LEGAL_REVIEW.md

@@ -23,6 +23,6 @@ This is an engineering audit checklist, not legal advice. Resolve these points w
 
 ## Third-party materials
 
-- Recheck the current Adobe Mixamo terms for redistribution of `xbot.glb` and `jumping-jacks.fbx`, especially for npm, source archives, hosted demos, white-label offerings, and customer redistribution.
+- Recheck the current Adobe Mixamo terms for redistribution of `xbot.glb`, `avatar2.glb`, `avatar3.glb`, and `jumping-jacks.fbx`, especially for npm, source archives, hosted demos, white-label offerings, and customer redistribution.
 - Replace the remaining Mixamo-derived files with owned or clearly redistributable assets if the intended distribution is not covered.
 - Run a dependency and source-provenance audit for every release artifact, including bundled JavaScript, model files, fonts, images, and generated content. Preserve all required notices.

docs/legal/THIRD_PARTY_NOTICES.md

@@ -7,8 +7,14 @@ Posecode npm packages use dependencies under permissive licenses including MIT,
 The following committed files originate from Adobe Mixamo character or animation exports and are governed by the applicable Adobe terms, not Apache-2.0 or AGPL-3.0:
 
 - `playground/public/models/xbot.glb`
+- `playground/public/models/avatar2.glb` (Mixamo "Beta" character)
+- `playground/public/models/avatar3.glb` (Mixamo "Remy" character)
 - `playground/public/clips/jumping-jacks.fbx`
 
+Provenance for the two avatar characters is established by their glTF contents:
+both carry the `mixamorig:` skeleton, a `mixamo.com` animation track, and Mixamo
+mesh and texture names (`Beta_Joints`/`Beta_Surface` and `Remy_Body_*`).
+
 The software licenses in this repository do not grant independent rights to extract, redistribute, or relicense these assets. Review the current Adobe Mixamo terms before redistribution. Posecode also provides a code-generated procedural figure that does not require these assets.
 
 `playground/public/models/character.glb`, an older unused Mixamo-derived character, was removed before the 0.3.0 release. The hosted embed default now uses the same active XBot asset as the playground.