feat(host): vendor PyroWave + minimal Granite subset as crates/pyrowave-sys

Phase 0 of design/pyrowave-codec-plan.md — the opt-in wired-LAN ultra-low-
latency codec. Vendored at upstream 509e4f88 (API 0.4.0, Granite 44362775,
volk + vulkan-headers pins in PUNKTFUNK-VENDOR.txt), pruned to the 6.6 MB
the standalone no-renderer build needs; scripts/vendor-pyrowave.sh
reproduces the tree (a pin bump is protocol-affecting, plan §4.2).

build.rs drives the wrapper CMakeLists (static archives incl. a static
C-API lib upstream only ships shared) + bindgen over pyrowave.h; Linux and
Windows only, empty stub elsewhere (Apple gets a native Metal port, §4.7).
Offline-safe by construction: no network, no system lib, vendored Vulkan
headers — same model as the opus dep (flatpak builder has no network).

Phase-0 validation on .21 (RTX 5070 Ti, driver 610.43.03):
- upstream pyrowave-c-test + interop test (incl. dmabuf/DRM-modifier
  Vulkan<->Vulkan) pass, from the pristine AND the pruned tree
- GPU kernel times at ~1.6 bpp noise: encode/decode 0.090/0.042 ms @800p,
  0.146/0.067 @1080p, 0.226/0.103 @1440p, 0.477/0.201 @4K — order of
  magnitude under NVENC's 1-2 ms retrieve, CBR lands within ~100 B of
  target
- cargo test -p pyrowave-sys green (static link + API-version pin check)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/vendor-pyrowave.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Re-vendors PyroWave (+ the minimal Granite subset it builds against) into
+# crates/pyrowave-sys/vendor/pyrowave. Network access required; run manually,
+# never from CI or build.rs (the flatpak/CI builders are offline — that is the
+# whole reason the tree is committed).
+#
+# ⚠️ Bumping PYROWAVE_COMMIT is a protocol-affecting change: the PyroWave
+# bitstream has no version field, so the CODEC_PYROWAVE wire bit means
+# "PyroWave bitstream as of this pin" (design/pyrowave-codec-plan.md §4.2).
+# A bump that changes the bitstream must bump the punktfunk protocol version,
+# and the Apple Metal hand-port (§4.7) must re-diff the two decode shaders +
+# bitstream header structs.
+set -euo pipefail
+
+PYROWAVE_COMMIT=509e4f887b585a3f97471fcc804e9de649f2c16f
+# The Granite pin + submodule set come from upstream's checkout_granite.sh at
+# that commit; recorded here for the vendor manifest only.
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+DEST="$REPO_ROOT/crates/pyrowave-sys/vendor/pyrowave"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+git clone https://github.com/Themaister/pyrowave "$WORK/pyrowave"
+git -C "$WORK/pyrowave" checkout "$PYROWAVE_COMMIT"
+(cd "$WORK/pyrowave" && bash checkout_granite.sh)
+
+GRANITE_COMMIT="$(git -C "$WORK/pyrowave/Granite" rev-parse HEAD)"
+VOLK_COMMIT="$(git -C "$WORK/pyrowave/Granite/third_party/volk" rev-parse HEAD)"
+VKHDR_COMMIT="$(git -C "$WORK/pyrowave/Granite/third_party/khronos/vulkan-headers" rev-parse HEAD)"
+
+cd "$WORK/pyrowave"
+rm -rf .git Granite/.git
+rm -f Granite/third_party/volk/.git Granite/third_party/khronos/vulkan-headers/.git
+# Upstream's own .gitignore files ignore the Granite checkout (`/Granite`) —
+# fatal for a committed vendor tree; strip them all.
+find . -name .gitignore -delete
+
+# Everything below is never entered by the standalone configure that
+# crates/pyrowave-sys/CMakeLists.txt performs (GRANITE_SHIPPING=ON,
+# GRANITE_RENDERER=OFF, GRANITE_PLATFORM=null, no PYROWAVE_DEVEL) — verified
+# empirically: configure fails loudly if a needed dir goes missing.
+# third_party/renderdoc stays: Granite adds it unconditionally.
+rm -rf Granite/renderer Granite/ui Granite/scene-export Granite/video \
+       Granite/audio Granite/physics Granite/tests Granite/tools \
+       Granite/viewer Granite/assets Granite/slangmosh Granite/network \
+       Granite/.github Granite/third_party/mikktspace
+# vulkan-headers: the build needs the C headers + CMake package only.
+rm -rf Granite/third_party/khronos/vulkan-headers/registry \
+       Granite/third_party/khronos/vulkan-headers/tests
+rm -f Granite/third_party/khronos/vulkan-headers/include/vulkan/*.hpp \
+      Granite/third_party/khronos/vulkan-headers/include/vulkan/*.cppm
+
+mkdir -p "$(dirname "$DEST")"
+rm -rf "$DEST"
+cp -a "$WORK/pyrowave" "$DEST"
+
+cat > "$DEST/PUNKTFUNK-VENDOR.txt" <<EOF
+Vendored by scripts/vendor-pyrowave.sh — do not edit by hand.
+
+pyrowave:        $PYROWAVE_COMMIT
+Granite:         $GRANITE_COMMIT
+volk:            $VOLK_COMMIT
+vulkan-headers:  $VKHDR_COMMIT
+
+Tree is pruned to what the pyrowave-sys standalone build needs
+(see the rm -rf list in the script). All parts are MIT-licensed
+(pyrowave, Granite) or Apache-2.0/MIT (volk, Vulkan-Headers).
+EOF
+
+echo "Vendored pyrowave@${PYROWAVE_COMMIT:0:12} (Granite ${GRANITE_COMMIT:0:12}) into $DEST"
+du -sh "$DEST"