fix: vendor the C sources as submodules so docs.rs can build

[ihrfv]

docs.rs builds with networking disabled, and rayforce-sys/build.rs cloned the C core from GitHub at build time — so both rayforce and rayforce-sys 1.0.1 fail there with Could not resolve host: github.com. The same failure hits any firewalled consumer.

The core and rayforce-q now ship as git submodules under rayforce-sys/vendor/. Cargo packs submodule contents into the published .crate, so the build needs no network at all.

Changes

• Submodules pinned at core v2.5.8 / q 2.0.0. clone_pinned() and the RAYFORCE_REPO/RAYFORCE_REF constants are gone — the submodule commit is the only pin, so build.rs and release.yml can't disagree again (they already had: v2.5.8 vs v2.5.1).
• include whitelist in rayforce-sys/Cargo.toml. The vendored repos carry test suites and a website; make lib needs only src/*/*.c, include/ and the Makefile. Packaged crate: 183 files, 1.4 MiB compressed.
• Staged build. The core's Makefile builds in-tree, so the vendored copy is mirrored into OUT_DIR first — otherwise the build writes into the shared registry cache, and cargo package fails its verify step. A RAYFORCE_SRC checkout is still built in place.
• Explicit version stamping. The Makefile reads RAY_VERSION/GIT_HASH from git, and git searches upward from the build dir — unset, it stamped an unrelated repository's HEAD into librayforce.a. Both are now passed explicitly and checked by scripts/check-vendored-pin.sh.
• rayforce-sys/wrapper.h deleted. It hand-copied 13 declarations for core symbols missing from the public rayforce.h — the only option while the core was cloned at build time. Now that the private headers ship, bindgen reads them directly, so a signature can no longer drift from the core silently: C linkage matches on name alone, and bindgen only ever saw the copy. That already cost a manual fix in 3fecff2, when the poll API moved into the public header and changed its return type. CORE_PRIVATE_HEADERS and INTERNAL_FNS in build.rs replace the file. What had kept it alive was the allowlist rather than header availability — ray_.* was safe only because bindgen's sole include path was include/; bounding generation to the public header lets the private ones onto the path without pulling in ~550 internal functions.
• Two constraints that surfaced, both pinned at the bindgen boundary only — the core is still compiled by its own Makefile. lang/internal.h is the only header declaring the splayed/parted builtins and it reaches mem/heap.h:442's _Atomic global, which bindgen 0.70 cannot resolve; it aborts the whole parse before any allowlist applies, so the keyword is defined away for the parse (both atomics involved are unallowlisted file-scope globals, and rayforce.h never says _Atomic, so no emitted layout can shift). And core/runtime.h:114 completes ray_runtime_s, which rayforce.h:656 leaves opaque — left alone bindgen would publish ray_vm_t and friends, ~67 KB of private layout that would churn on every core bump.
• CI: one submodules: recursive checkout replaces the three separate ones. This also fixes what CI tested — ci.yml pinned no ref, so it built against core master. Adds the pin check and a guard that the .crate actually carries the vendored sources.
• Passes -j$NUM_JOBS to make (it ran serially) and drops -Werror from the vendored build, so a future compiler's new diagnostic isn't a hard failure in someone else's dependency tree.

Verified

• Packaged the crate, extracted it somewhere with no .git, empty HOME, no RAYFORCE_SRC, and ran cargo rustdoc --lib --offline — i.e. what docs.rs does. Succeeds.
• Fresh git clone --recurse-submodules builds and passes all 15 test binaries; fmt and clippy -D warnings clean.
• librayforce.a reports rayforce 2.5.8 (f0d4bb4), matching the pinned submodule.
• Bindings regenerated from scratch match the previous wrapper.h output except for ray_runtime_s, now a 40-byte opaque blob rather than zero-sized. It is only ever held by pointer (rayforce/src/runtime.rs:22), and the old size was wrong regardless. 84 tests pass; the packaged .crate carries no wrapper.h and no build artifacts.

docs.rs won't retry 1.0.1, so this needs a 1.0.2 release to take effect.

🤖 Generated with Claude Code

[protocolstardust]

Approved, thanks for the effort!