chore(deps): make WGSL vendoring reproducible and use Cargo-native dependency boundaries

[ScriptedAlchemy]

Scope

Follow-up to #1053's review split. This issue improves the maintained dependency boundary; merely moving bytes into a preparatory PR does not solve provenance, upgrades, or build invalidation. Source review at #707 e8ef14b212d3a962156648714bf9104595965ae8. No build or compatibility benchmark was executed.

Verified evidence

The complete crates/tracedecay-code-extraction/vendor/tree-sitter-wgsl Git subtree contains just:

File	Source bytes
src/parser.c	830,121
src/scanner.c	1,904
src/tree_sitter/parser.h	5,378

There is no colocated upstream revision/checksum record, grammar source, regeneration recipe, or license/notice file in that subtree. This is a traceability gap in the inspected import, not a claim that the repository has no notice elsewhere or that a license violation is proven. Locate any existing repository-wide attribution and link/reuse it before adding another authority.

ts_provider.rs explains the compatibility workaround: the old tree-sitter-wgsl Rust crate targets Tree-sitter 0.20, while TraceDecay uses 0.26, so the application redeclares the raw C entry point and wraps it in tree_sitter_language::LanguageFn. The published 0.0.6 package metadata independently shows tree-sitter ~0.20.6; simply restoring that dependency is not a compatible fix.

build.rs compiles parser/scanner through cc but declares rerun-if-changed only for those two .c files. The scanner includes tree_sitter/parser.h; the tracked header is not an explicit invalidation input. Cargo narrows file watching once rerun-if instructions are emitted.

Smallest acceptable outcome

1. Establish the actual upstream identity of all three imported files from package/commit bytes, not just a repository with the same name. Record immutable revision or release checksum, exact imported paths, generator version if regeneration is required, and any local patch. Preserve the appropriate upstream notices in source/package distribution.
2. Prefer an existing compatible published grammar binding if one is verified to preserve the required grammar/output. Otherwise either:
   • maintain a tiny pinned fork of the actual grammar package using tree-sitter-language::LanguageFn and consume it through Cargo; or
   • retain this narrow native import with a concise provenance/update recipe.
     Moving 19 lines of local build glue into a new package is not automatically a maintenance win. Choose based on reuse and ownership, not directory aesthetics. Do not adopt a different WGSL dialect or new grammar revision under the label of a behavior-preserving packaging refactor.
3. While the local build remains, replace the incomplete two-file watch with the exact complete source input set (including the header), or one cargo::rerun-if-changed=vendor/tree-sitter-wgsl/src directory watch. Reuse Cargo's own change detection. No custom recursive hash inventory, code-generation manager, or build-time network downloads.
4. Ensure the extraction crate's explicit include list includes any required attribution/provenance when source is packaged. Distinguish generated parser.c from upstream-authored scanner/build logic so local changes remain reviewable.

Rust dependency practice for this repository

• Ordinary released dependencies: registry dependency plus the application lockfile. Do not copy source merely to freeze a version.
• Necessary upstream fixes: root [patch.crates-io] with immutable Git revisions and the lockfile, as the Rust grammar, FastEmbed, and Grafeo already do. Record the upstream fix/removal criterion. Keep Grafeo sibling crates on a coherent revision; do not remove those entries merely because the pins repeat.
• Required offline dependency material: generate a scoped readonly source replacement with cargo vendor --locked, keep the matching lockfile/configuration/checksums, and preserve checkout bytes.
• The source-provenance fixture already follows the latter pattern with its standalone manifest, lockfile, regeneration README, per-fixture Cargo home, and shared immutable vendor directory. Keep that hermetic boundary; do not rewrite its JSON parsing or depend on ambient Cargo caches to shrink test files.
• Do not run cargo vendor over the entire application as an unconditional policy: it copies the whole resolved remote dependency graph and can greatly increase repository footprint. A source-replacement snapshot is not the place for undocumented local edits; use [patch]/an explicit fork for changed dependencies.

Acceptance

• Every retained WGSL source byte has a reproducible upstream import or explicitly reviewable patch history.
• One documented update/import operation can recreate the intended snapshot; no moving branch or network access during normal builds.
• Header-only changes invalidate/rebuild the native object; an unchanged second build is a no-op.
• Existing WGSL extraction fixtures, canonical output and retained-tree behavior are unchanged for a packaging-only change. Any grammar behavior change is separate and explicit.
• Source/package attribution survives the relevant include/package rules.
• Before/after source bytes, clean build time, and executable size are reported separately if an externalized binding is adopted; no claim that removing tracked C files automatically removes binary weight.

Primary references

• https://doc.rust-lang.org/cargo/commands/cargo-vendor.html
• https://doc.rust-lang.org/cargo/reference/source-replacement.html
• https://doc.rust-lang.org/cargo/reference/overriding-dependencies.html
• https://doc.rust-lang.org/cargo/reference/build-scripts.html#change-detection
• https://docs.rs/crate/tree-sitter-wgsl/0.0.6

Keep #707 draft. #1053 owns review decomposition; #978 owns language-tier dependency/registration footprint. Do not expand this into a new general-purpose vendoring framework.

[ScriptedAlchemy]

Continuation at 3d955ff998eef120cd398f163c613a54e3383ccb

Re-read the current extraction manifest and build.rs. The local WGSL compilation still watches only parser.c/scanner.c, so the header-invalidation finding remains. There is one additional small case to include in the same fix: with lang-wgsl disabled, main returns without emitting any rerun-if directive. Cargo then uses its default package-wide change detection even though this build script has no native work for that feature selection. Give the feature-off path the minimal build-script invalidation contract instead of scanning the extraction package unnecessarily; Cargo already owns feature-resolution changes. Do not implement another source-hash inventory. Keep complete parser/scanner/header tracking when enabled.

The current cc build dependency is unconditional and lang-wgsl = []. Making it feature-owned is an option only if the resulting conditional build-script code is simpler/useful; other selected grammars may already build cc, so removing this one dependency edge is not evidence that the whole toolchain disappears. The important fixes are reproducible provenance and correct/narrow invalidation, not optimizing a manifest line without measurement.

Official basis: Cargo's Build Scripts chapter, Change Detection, documents package-wide scanning without rerun directives and the no-work rerun-if-changed=build.rs pattern: https://doc.rust-lang.org/cargo/reference/build-scripts.html#change-detection

No extraction build or header-only regression was executed here. Keep the packaging-only refactor behavior-preserving and coordinate any tier/dependency work with #978.