Refresh vcpkg builtin-baseline to upstream HEAD

[Copilot]

Pull Request

For EPIC-branch workflow PRs, use .github/PULL_REQUEST_TEMPLATE/epic-branch-flow.md.
This applies to both feature/* -> epic/* and epic/* -> develop integration PRs.

Target Version (Required)

Target Version: [Unreleased]

This is an infrastructure/dependency freshness maintenance update. It keeps the repository aligned with the current upstream vcpkg baseline and restores the compliance gate without changing runtime behavior.

---

Description

The repository’s vcpkg.json manifest was pinned to a stale builtin-baseline, which caused the supply-chain compliance workflow to flag the dependency freshness gate. This change refreshes the manifest to the current upstream vcpkg HEAD so the validation remains current and the repo remains in compliance.

• Updates vcpkg.json to the current upstream builtin-baseline SHA.
• Keeps the dependency manifest aligned with the repository’s compliance and SBOM checks.
• No application logic, API, or runtime behavior changes.

Linked Issues

N/A — issue linkage is handled separately by the repository automation.

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other:

Breaking Change Checklist

• MAJOR version bump planned in VERSION and CMakeLists.txt
• Migration guide added in docs/migration/
• Announcement prepared for GitHub Discussions (≥ 2 weeks before release)
• CHANGELOG ### Removed / ### Changed section updated

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • T0 Trusted Core
  • T1 Security & Platform Services
  • T2 Data Plane Engines
  • T3 Interface & Protocol Edge
  • T4 Managed Extension Runtime
  • T5 Plugin Boundary
  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)

• Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)

• Boundary-focused tests added/updated or explicit N/A rationale provided

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?
  • Falls JA: Research-Dateien in /docs/research/ angelegt?
  • Falls JA: Im Modul-README unter "Wissenschaftliche Grundlagen" verlinkt?
  • Falls JA: In /docs/research/implementation_influence/ eingetragen?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md)
• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt
• RAII und Exception-Safety für neue/angepasste Pfade geprüft
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Performance-Metriken geprüft, falls Hotpath betroffen

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md
• Security hardening review performed for security-sensitive/runtime changes with .github/prompts/security-hardening-review.prompt.md (or N/A documented)
• API impact review performed for API/contract changes with .github/prompts/api-change-impact-review.prompt.md (or N/A documented)
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

High-Finding Exception Record (only if High is accepted)

• High-finding exception claimed in this PR

• Finding reference:

• Maintainer approver:

• Mitigation in current release:

• Target fix milestone:

• Tracking issue:

• Validation evidence:

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Code follows project style guidelines (clang-format / clang-tidy)
• Self-review completed
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased]
• No new warnings introduced
• Security-sensitive paths reviewed by security maintainer (if applicable)

Scanner and IntelliSense Gates

• IntelliSense/Compiler: no new errors in changed files
• clang-tidy/cppcheck: no new high-risk findings in changed files
• Gap Scanner: no new critical findings in categories security, input_validation, query_correctness, distributed_consistency, concurrency, memory
• Gap Scanner: no new high findings in the same categories (or explicitly approved)
• Gap Scanner delta report attached (baseline vs current), not only absolute totals
• New unknown scanner findings triaged (fixed, re-categorized, or justified)

• Fixes [CI] vcpkg baseline is stale — dependency freshness gate #6262

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Wave C Policy Gate: Hash & SBOM Integrity

Result: ✅ Hash & SBOM Integrity PASSED
Workflow run: #34084094343
Triggered by: @Copilot

Checks

• ✅ Dependency hash integrity check
• ✅ SBOM generation and registry consistency
• ✅ Edition-correct SBOM composition
• ✅ Private plugin variance detection
• ℹ️ Approved SBOM registry: docs/governance/SBOM_APPROVED_VERSIONS.md

See .github/workflows/gate-pr-hash-sbom.yml for details.