chore(vendor): stacked vendor-only PR for #707 — generated vendor churn, land first

[ScriptedAlchemy]

Stacked vendor PR for #707 (stack position 1 of 2 — land this first)

This PR carries only the generated/vendored third-party churn from #707 (codex/tracedecay-total-redesign-plan-reopened), split out so that #707's GitHub diff shows the real product change instead of ~1M lines of generated parser noise. #707 has been retargeted to base on this branch; this PR must land before it.

Do not merge until explicitly authorized (same rule as #707).

Contents (vendor trees copied byte-for-byte from #707 HEAD)

Path	Change	Lines
vendor/tree-sitter-cobol/	deleted (incl. the 825k-line generated src/parser.c)	−840,930
vendor/tree-sitter-protobuf/	deleted	−8,495
crates/tracedecay-runtime-core/src/privacy/rules/vendor/gitleaks/	added (vendored gitleaks ruleset + LICENSE/PROVENANCE)	+3,364

Total: 10 files, +3,364 / −849,425 (raw git diff --no-renames vs master).

No more vendored tree-sitter-rust

Earlier revisions of this PR added vendor/tree-sitter-rust/ and crates/tracedecay-code-extraction/vendor/tree-sitter-rust/ (~225k lines of generated parser). Those trees are gone from the whole stack: #707 now consumes the patched Rust grammar as a git dependency pinned to an explicit commit (vanessa-rodrigues/tree-sitter-rust @ 877df9f8, the head of upstream PR tree-sitter/tree-sitter-rust#301 which carries the struct-pattern field attribute fix). This branch was force-pushed to drop those additions so we are not adding files only for #707 to delete.

Why this is safe standalone

None of these trees are referenced by the build on master: the cobol/protobuf grammars are consumed from the crates.io tokensave-large-treesitters package (not the root vendor/ sources), and the gitleaks ruleset is inert until #707's code wires it up. No Cargo.toml/Cargo.lock changes are included.

Deliberately excluded: vendor/libsql/

master's root Cargo.toml patches libsql = { path = "vendor/libsql" }, so deleting that tree standalone would break the build. Its deletion (−16,653 lines, 66 files) stays in #707 where it travels with the libsql-removal migration that makes it safe.

  

[changeset-bot]

⚠️ No Changeset found

Latest commit: c7fcf3f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d8f2a1793

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Correct the vendored ruleset hash

The recorded integrity value does not match the file added by this commit: running git hash-object crates/tracedecay-runtime-core/src/privacy/rules/vendor/gitleaks/gitleaks.toml returns f4b6942c394e6059b36ad10aa1b13143ff1335ae, not 256f64790ea6d954f0041024be2938089ae1e7a7. Anyone following the documented provenance or refresh procedure will therefore fail verification and cannot establish that the privacy rules are the claimed byte-for-byte upstream copy; either restore the intended upstream file or record its actual hash.

Useful? React with 👍 / 👎.