Move the vcpkg baseline, and stop the tool drifting behind it

[nnewson]

Baseline ea1a7396 (Aug 2026) -> a1cae005 (Sep 2026). A small move as these go: imgui 1.92.8#1 -> 1.92.9 and catch2 3.15.3 -> 3.16.0, with everything else unchanged. vulkan-headers and vulkan-loader stay at 1.4.357.0, still matching the SDK installed on the development machine, which is what keeps the mixed-vulkan-hpp trap out of reach rather than merely survivable.

Taken now because the rule says between items and before a perf item, never after one: the next arc includes measurement work, and a number taken across a toolchain move cannot be attributed to the change that was supposed to cause it.

THE CHECKOUT IS PINNED TO THE SAME COMMIT, which is the substantive half of this change. Every job checked vcpkg out at master, so the baseline fixed port VERSIONS while the tool, the triplets and the toolchain scripts floated free. Two consequences, and we have now met both: CI could break with no change in this repository, and a green run said nothing about the next one. A recent macOS failure looked for all the world like our problem and turned out to be a mid-stream HTTP/2 reset fetching a tarball — the diagnosis cost more than it should have precisely because "nothing changed here" was not evidence of anything.

The SHA now appears in three places that must agree, and they move together or not at all: the baseline in vcpkg-configuration.json, the ref: on all four Checkout vcpkg steps, and VCPKG_COMMIT in container-run.sh. The Docker replica fetches BY SHA rather than by branch, so a persistent volume already holding the pin does no network work, and one holding an older pin moves to exactly this commit instead of to whatever master is today — which is what makes it a replica of CI rather than a second, differently-drifting build.

The native macOS replica is the exception and is documented as such: it uses whatever VCPKG_ROOT the machine has, because pinning it would mean a script taking charge of someone's personal checkout. It is therefore the one runner that can drift, and a macOS-only failure CI does not reproduce should be treated as a suspect local checkout first.

Verified the way a bump has to be. Full --clean-first rebuild on both platforms, because vcpkg preserves upstream file timestamps and an upgraded header can land older than the objects including it — the imgui bump that produced a runtime IMGUI_CHECKVERSION abort from a green incremental build is the precedent. tests-full on macOS (1707 cases) and on Linux in the Docker replica (1707 cases, all six guards), the Release contract on both, clang-tidy clean on Linux, and the render smoke with validation enabled: alive, SIGTERM 143, zero VUIDs, and no version-mismatch line.

The determinism golden did not move on either platform, which is the result a dependency bump should produce. A moved hash here would have been a regression to investigate, not a golden to rewrite.

[nnewson]

Landed as 45ded53 on 2026-09-12; GitHub did not record the merge during the Actions incident.