Resolve each dependency where it is linked, and prove plain CMake without ost

[snkmcb]

This PR makes plain CMake a proven build contract. usd-motion-plugins is consumed only as an installed package, each member declares exactly the packages it uses, and a CI lane with no ost in it builds and tests the workspace.

Dependency boundary

• The root resolves no consumed package. It used to find_package all five motion packages, so every configure required every package, including motionRecording, which nothing here includes. Each member now resolves what it links through usdvrm_consume_package() (cmake/UsdVrmConsumedPackage.cmake). The function runs find_package in function scope, so pxrConfig's Python3 clobbering does not leak, and it promotes the targets it created to IMPORTED_GLOBAL, so later members and root tests reuse one definition.
• Unused edges are removed. execVrm linked motionSampling and motionRecording, and its descriptor pinned them, from MIG-1 on, but no source includes either. motion_retarget included motionCore/ headers without linking motionCore. motionRecording is no longer consumed at all. The graph drops from 15 to 13 library edges.
• usdvrm_baseline asks USDVRM_COMPOSED_BUILD. It used to ask whether motionCore's target was visible, and once the root stopped resolving packages that test would have unregistered the gate silently.

Member	Consumed packages
vrmContainer, vrmSchema, usdVrmFileFormat, usdVrmPackageResolver	none
vrmRig, usdVrmaFileFormat	motionCore
execVrm	motionCore, motionRetarget
motion_retarget	motionCore, motionRetarget, motionSampling, motionUsd

Enforcement: scripts/check_cmake_boundaries.py

The script is static and needs no build. It is registered as workspace_cmake_boundaries plus a self-test (18 cases). It fails on:

• a source tree of another repository: add_subdirectory leaving the repo, FetchContent, or ExternalProject
• a usd-motion-plugins identity built here
• the root resolving a consumed package, including through a foreach loop
• a member reaching a package that WORKSPACE.md §2 does not allow. The VRM importer may reach no motion package, and the .vrma importer may reach neither vrmRig nor motionRetarget.
• a member whose resolved, linked and included packages are not the same set
• a descriptor whose requires.libraries disagrees with its CMake
• given an installed motion include/: any code there that knows VRM

Run against main, it reports 17 violations.

CI: .github/workflows/plain-cmake.yml

The lane runs OpenUSD install + cmake --install of usd-motion-plugins → cmake → build → ctest on ubuntu-24.04, and fails if ost is on PATH. It copies no pin. scripts/plain_cmake_inputs.py supplies the inputs:

• It fetches the Linux workspace cell's runtime archive by digest over plain HTTPS. The archive is an ordinary OpenUSD prefix.
• It builds usd-motion-plugins from the commit that the pinned packages' SLSA provenance names. It checks that every pin agrees on that commit, which today is v0.5.1 9256f93.
• It fetches execMotion from execVrm's pin.

Fix found by the new lane

libExecMotion.so as published carries its producer's CI checkout as its RUNPATH, so it opens only when LD_LIBRARY_PATH names OpenUSD. ost test sets that variable. The suites only prepended PATH, so on Linux outside ost, execVrm_diagnostics and workspace_exec_driver failed with the plugin never loaded. The failure was bisected with LD_DEBUG, and a C++20 build and a build against the published motion libraries were both ruled out. USDVRM_EXEC_MOTION_ENV now carries the platform's loader variable, and every suite that composes the bundle uses it. The ost side is filed as a P3 in report 48 (#229).

Verification (local)

• Plain CMake, Windows (VS 18, no ost): 40/40
• Plain CMake, Ubuntu 24.04 container mirroring the workflow step by step: 40/40. Before the loader fix it was 38/40.
• Standalone configure and build of all 8 members, each against a prefix holding only its allowed packages: all ok. main's execVrm fails that test on motionSampling.
• ost build + ost test (0.23.6): 40/40. ost plugin test --workspace --graph-only: valid. Package-consumer lane: 3/3 PASS.
• check_docs.py: OK

The new lane itself only runs on this PR.

🤖 Generated with Claude Code