feat: make client sources upstream-independent

[bashrusakh]

Summary

• replace the libs/hbb_common submodule with tracked source
• migrate locked Cargo git package roots and Flutter git packages to owned local paths
• localize the TopMostWindow workflow source and preserve PR workflow: harden client builds and artifacts #4 build hardening
• add fail-closed source ownership, Cargo source, vendor provenance, integrity, and workflow validation
• preserve canonical vendor line endings for 12 files so copied-root bytes match the approved vendor evidence

Scope and limitations

This PR covers the source-ownership migration and validation scaffolding. It does not claim final offline independence:

• the full repository-relative Cargo registry vendor/ tree is intentionally not included
• Flutter dependency/build validation is deferred to the repository's GitHub Actions/F-Droid workflows; local Flutter/Dart installation is not required for this migration
• no real GitHub Actions run or accepted network-isolated build matrix has been performed
• copied hwcodec SDK/SDL inputs remain subject to maintainer redistribution/license review
• preserved upstream/copied sources contain inherited whitespace; current worktree checks are clean, while full commit-diff checks report inherited/copied third-party whitespace, including the 12 intentional CRLF vendor files covered by .gitattributes -text

Validation

• python3 -m unittest scripts/test-check-flutter-source-ownership.py -v
• python3 scripts/check-flutter-source-ownership.py --require-window-pin RustDeskTempTopMostWindow ecd8d6a139eee76845ea66423fb739af450fda90
• python3 scripts/check-cargo-git-sources.py
• cargo metadata --locked --no-deps --format-version 1
• external vendor directory and archive verification: 1,005 registry packages and 44/44 copied roots
• focused YAML, lockfile, workflow, provenance, artifact, and negative integrity checks
• portable reproducibility tests: 8/8 passed

Available focused checks pass. Full CI/build execution remains for GitHub Actions/F-Droid, and the unavailable registry-vendor/offline matrix gates remain explicitly open.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b39c8c9c-ac3c-4116-9426-0799378aacd7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}