chore: sync vcpkg builtin-baseline to pinned submodule SHA (fixes dependency-freshness gate)

[Copilot]

vcpkg.json builtin-baseline was out of sync with the pinned vcpkg submodule commit, causing the compliance-supply-chain workflow's dependency-freshness job to flag staleness and open issue #6315.

Changes

• vcpkg.json: Updated builtin-baseline from 10b7a178346f3f0abef60cecd5130e295afd8da4 → 5cd4931b18d49c77074703cf293a7837ac7506fa to match the SHA pinned in .gitmodules for the vcpkg submodule.

Target Version (Required)

Target Version: [Unreleased]

Infrastructure maintenance fix; no feature or API impact.

---

Description

Single-field update to realign vcpkg.json builtin-baseline with the vcpkg submodule pin. The compliance workflow clones vcpkg at the submodule SHA and compares against builtin-baseline; a mismatch triggers a staleness issue. No dependency versions changed — this is purely a manifest/submodule consistency fix.

Linked Issues

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other: infrastructure/manifest hygiene

Breaking Change Checklist

• MAJOR version bump planned in VERSION and CMakeLists.txt
• Migration guide added in docs/migration/
• Announcement prepared for GitHub Discussions (≥ 2 weeks before release)
• CHANGELOG ### Removed / ### Changed section updated

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed — verified submodule SHA via git ls-files -s vcpkg; secret scan clean
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)

• Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)

• Boundary-focused tests added/updated or explicit N/A rationale provided

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?
  • Falls JA: Research-Dateien in /docs/research/ angelegt?
  • Falls JA: Im Modul-README unter "Wissenschaftliche Grundlagen" verlinkt?
  • Falls JA: In /docs/research/implementation_influence/ eingetragen?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md)
• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt
• RAII und Exception-Safety für neue/angepasste Pfade geprüft
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Performance-Metriken geprüft, falls Hotpath betroffen

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md — N/A (single JSON field change)
• Security hardening review performed — N/A (no runtime paths affected)
• API impact review performed — N/A (no API changes)
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description — none
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

High-Finding Exception Record (only if High is accepted)

• High-finding exception claimed in this PR

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Code follows project style guidelines (clang-format / clang-tidy)
• Self-review completed
• Documentation updated (if needed) — N/A
• CHANGELOG.md updated under [Unreleased] — N/A (no behavior change)
• No new warnings introduced
• Security-sensitive paths reviewed by security maintainer (if applicable) — N/A

Scanner and IntelliSense Gates

• IntelliSense/Compiler: no new errors in changed files — JSON manifest only
• clang-tidy/cppcheck: no new high-risk findings — no C++ changes
• Gap Scanner: no new critical findings — no source changes
• Gap Scanner: no new high findings — no source changes
• Gap Scanner delta report attached — N/A
• New unknown scanner findings triaged — N/A

• Fixes [CI] vcpkg baseline is stale — dependency freshness gate #6315

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Wave C Policy Gate: Hash & SBOM Integrity

Result: ✅ Hash & SBOM Integrity PASSED
Workflow run: #34682074638
Triggered by: @Copilot

Checks

• ✅ Dependency hash integrity check
• ✅ SBOM generation and registry consistency
• ✅ Edition-correct SBOM composition
• ✅ Private plugin variance detection
• ℹ️ Approved SBOM registry: docs/governance/SBOM_APPROVED_VERSIONS.md

See .github/workflows/gate-pr-hash-sbom.yml for details.