Adopt one CMake dependency contract for plain CMake and ost

[snkmcb]

Summary

One CMake dependency contract, driven three ways: plain CMake on the repository, plain CMake on a single component, and ost. The only difference between them is who prepares the dependency prefix (WORKSPACE.md §5).

• Edges. Inside the repository an edge is the in-tree target when it exists and the installed package otherwise. Outside it, the edge is always an installed package, and the component that links it declares it. The adapters now find motionRetarget / motionCore themselves. The root lists no external package except OpenUSD, which it still resolves once, before any component that may link it; the pure libraries are added before that point.
• Presets. CMakePresets.json no longer reads USD_INSTALL_ROOT. The caller passes the prefix as CMAKE_PREFIX_PATH, either as -D or as the environment variable.
• cmake/ modules, one per concern. None of them hides add_library(), target_link_libraries() or a dependency:
  • UsdMmdProject: USDMMD_VERSION and usdmmd_component(). The per-component version fallbacks are removed, and check_docs.py now requires every project() to use ${USDMMD_VERSION}.
  • UsdMmdSanitizers: USDMMD_SANITIZERS / USDMMD_BUILD_FUZZERS replace five per-component option pairs. They are applied per target instead of through add_compile_options.
  • UsdMmdPackage: usdmmd_install_library(), giving every plain library one layout, one version policy and one export.
  • UsdMmdTesting: test executables, boundary tests, the test interpreter, and the OpenUSD runtime environment.
  • UsdMmdOpenUsd: usdmmd_find_openusd() runs pxrConfig.cmake only where OpenUSD's targets are not yet visible, and checks the pin at every entry point.
• Fix. Outside an ost session, the adapter tests and the installed-consumer adapter probe could not start on Windows (0xc0000135), because nothing put OpenUSD's DLLs on PATH. They now set it themselves.
• Not done: staging outside the source tree. ost 0.23.3 reads a bundle's plugInfo.json and lib/, and a tool's directories, from the source directory. Staging into the build tree was measured: the build succeeds, but ost plugin test fails from L0 to L5. This is recorded in the new docs/reports/ost/ as report 01, which asks for verification from a staged layout.

The sanitizer workflow uses the new option names.

Test plan

Run locally on Windows (MSVC 19.51, CMake 4.4, ost 0.23.3):

• Plain CMake, repository: cmake --preset windows-msvc -B <new> with CMAKE_PREFIX_PATH = OpenUSD 26.08 plus the three pinned motion artifacts. 32/32 tests pass.
• Plain CMake, single component, against that tree's install: mmdPmx, mmdModel, mmdControl, mmdSkeletonAdapter, mmdMotionAdapter, vmd_inspect. Every suite passes, and the bundle configures and builds.
• ost build + ost test from a deleted tree: 32/32.
• ost plugin build / test plugins/usdMmdFileFormat: 12 pass, 0 fail.
• ost library build / test libs/mmdMotionAdapter and libs/mmdPmx, and ost library verify-consumer libs/mmdControl.
• Sanitizer chain of all five plain libraries with USDMMD_SANITIZERS="address;undefined", run on WSL with GCC 15: all pass.
• check_docs.py and --selftest.
• CI: every lane green, including macOS and Linux and the Clang fuzz targets (not run locally).

🤖 Generated with Claude Code