• debian/README.source is the maintainer's note on repacking and testing: its sentence 'The two SVG logos explicitly carry CC BY-NC terms' describes the files excluded from the orig tarball and matches Files-Excluded in debian/copyright; it does not state a licence for anything in the tree. Its instructions (mk-origtargz --copyright-file debian/copyright --repack-suffix +dfsg) produce exactly the four exclusions the tree shows.
• docs/slides/presentation/gfx/slides-executable_deps.dia (scan: gzip-compressed) is a gzip-compressed Dia diagram, the editable source for the build-dependency slide; the directory's wscript renders it with dia -t png, and the rendered PNG is not shipped. No licence wording inside; it is upstream's own source, covered by Files: *.
• playground/dynamic_build2/foo.tar (scan: tar archive) holds aa/main.c (23 bytes) and is the input to that playground demo's tar xvf ${SRC[0].abspath()} rule in wscript. Test data, not a built artifact.
• demos/mac_app/resources/MainMenu.nib/keyedobjects.nib (scan: unrecognised binary) is a compiled Cocoa interface; the editable XML source designable.nib (77 KB) is in the same directory, so the preferred form for modification is present.
• playground/maxjobs/foo.a, bar.a, truc.a are 7-14 byte dummy archives used as fixtures by playground/maxjobs/wscript, not built objects.
• playground/cython/cython_cache/src/cy_ctest.c and cy_cxxtest.cc begin /* Generated by Cython 0.29 */; their sources playground/cython/src/cy_ctest.pyx and cy_cxxtest.pyx are present, so the generated files are demo fixtures with their generator input in the tree.
• build_system_kit/nostate/README.txt:2 ('this example is for research purposes only') is an author's note that the example deliberately uses timestamps instead of signatures, not a licence restriction; the example's code is under the tree's BSD-3.
• playground/sphinx/src/conf.py:23 copyright = '2019, sphinx' (the scan's one unmatched holder) and docs/sphinx/conf.py:360 copyright = u'2005-2023 waf.io' are sphinx-quickstart / waf build-configuration strings (project = 'project', version = ''), not notices by the Sphinx project or a separate holder; both files are upstream's own and fall under Files: *.
• All four Files-Excluded paths are absent from the unpacked tree: docs/slides/presentation/gfx/waflogo.svg (the gfx directory holds only the .dia and a wscript), playground/rst/test.svg, docs/sphinx/_images/waf-64x64.png (_images is empty) and playground/xilinx-ise.
• Licence texts: LICENSE, waf-light, zip/waf-zip, utils/launcher/LICENSE, waflib/extras/codelite.py and waflib/extras/msvs.py all carry the same BSD-3-clause text as the License: BSD-3-clause paragraph; waflib/extras/eclipse.py:4 and waflib/extras/boost.py state the same (New) BSD licence.
• I read every comment header in the tree that carries a year (130 such lines) and every Copyright/__copyright__/__author__ line: the only licence that is not BSD-3 is demos/intltool/po/sv.po (# public domain, no copyright, matching its own stanza) and playground/gtest/tests/gtest_main.cc (// Copyright 2006, Google Inc., own stanza). demos/tex/src/bib.bib's 'author = Russel Winder and Graham Roberts' is a bibliography entry, and playground/stpl_c_py_cs_satellite_wix/src/gui/AssemblyInfo.cs.stpl and src/msi/readme.rtf contain placeholders (AssemblyCopyright("Copyright © {{company}} 2015"), 'This program itself is nonsense'), not notices.
• Images in the tree are only demos/mac_app/resources/MacApp.icns, demos/c/program/gfx/semfavicon.ico and playground/stpl_c_py_cs_satellite_wix/src/gui/Resources/Icon1.ico; none carries a separate notice, all are covered by Files: *, and none is installed in either binary package.
• utils/pubkey.asc is an ASCII-armoured PGP public key, used by utils/verify-sig.py; it is data, not a work with licence terms.
• debian/lrc.config containing just debian is the licencecheck-exclusion file documented in lrc(1) ('False positives may suppressed by creating a file debian/lrc.config'), not a stray configuration.
• The genpybind patch is consistent with the library it is applied to: waflib/Utils.py:585-588 defines shell_quote = shlex.quote and only falls back to pipes.quote on AttributeError, so Utils.shell_quote exists on Python 3.13 where waflib/extras/genpybind.py now uses it.
• debian/python3-waflib.install covers everything under waflib/: the tree has only .py files in waflib/, waflib/Tools/ and waflib/extras/ (no data files that the three install lines would miss).
• Packaging files read in full: control, rules, changelog, copyright, README.source, gbp.conf, lrc.config, salsa-ci.yml, source/format, both patches and patches/series, tests/{control,upstream,build}, upstream/metadata, waf.1, waf.dirs, waf.docs, waf.manpages, python3-waflib.{install,docs,README.Debian}. No maintainer scripts. waf and python3-waflib are found neither in the archive lists nor in the NEW queue under those names, so both are new binaries of this source and no conflict arises (checked with apt-cache). tests/{general,utils,preproc,post} compile nothing, and dh_installdocs installs debian/package.README.Debian automatically, as its manual page states.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (GPL-2).

• demos/intltool/data/kupfer.desktop.in and kupfer-mimetypes.xml.in carry no licence statement of their own and are declared BSD-3 by Files: *, but their names and the ../data/kupfer.desktop.in references in demos/intltool/po/sv.po show they were copied from the Kupfer project. Whether Kupfer's licence (recalled as GPL-3+, not checked here) needs its own stanza for two trivial desktop-entry/MIME data files that are not installed in any binary could not be decided from the package.

None.