[Docs]: Asset license audit + machine-readable manifest

[rosspeili]

Doc location

docs/assets-and-credits.md + new docs/assets-manifest.md or avatar-demo/assets-manifest.yml

What kind of change?

Missing section

What’s wrong or missing?

Roadmap item. Credits exist in prose, but there is no single machine-readable inventory of every bundled VRM/VRMA/GIF with source URL, license summary, and commercial-use notes. Harder to audit before release and for downstream redistributors.

Suggested fix (optional)

1. Inventory files under src/assets/avatars, VRMA, environments (built-ins only).
2. Manifest fields: path, type, source, license, credit line, notes.
3. Keep human doc in sync; link from README Assets section.
4. CONTRIBUTING: “update manifest when adding media.”

Checklist

• I searched existing issues for a duplicate