feat: integrate append-only GitHub package updates (draft CI)

[Sunrisepeak]

Declare updates for all 82 descriptors with direct GitHub resources and pin the merged openxlings/xpkgindex-update tool at 23c5e04948c55e606bc56ee2c649ddd4849b7ec6. Published version blocks, mirror URLs, hashes and comments are preserved; no automatic mirrors or merges.

Identical resources for new versions are defined once before the package and referenced by each platform. Existing inline versions stay untouched. Index CI verifies exact candidate resolution, including shared references, while ordinary consumer regression checks remain enabled. An optional manual package input supports targeted real scans.

The tool uses static Lua parsing and protects both references and their definitions. It rejects mutable/dynamic resources rather than guessing. README is a short project entry point; detailed usage is in the tool docs. Tool PR #1 is squash merged; its 59 tests, six OS/Python combinations and Action/packaging checks passed, including main CI.

Validation on final index head 45884cf:

• All 74 executed checks passed. The two existing conditional notification/publication jobs are skipped by their original rules.
• 52/52 real candidate build/run/lock checks passed with shared resource definitions: https://github.com/mcpplibs/mcpp-index/actions/runs/39304546112
• Full existing-consumer regression passed: 13 shards and all other validation, 19 executed jobs: https://github.com/mcpplibs/mcpp-index/actions/runs/39304546154
• Coverage and independent guard preserve existing version entries in all 254 descriptors.
• The real hiredis PR also passes all executed checks with one resource definition and three references: chore: append compat:hiredis 1.5.0 #544

Manual compatibility adaptations cover FreeType HVF, OpenMP runtimes/Windows Python, hiredis Windows source traversal, libuv synchronization linking, nanodbc ODBC/locale headers, Quill module scanning, mcr 0.2 API/standard-library changes, and preserved muduo/llama.cpp standard headers. llama.cpp's extra headers are scoped to Linux implementation sources. The updater never changes recipes or dependencies itself.

Temporary user-approved exception: wellwei/libmysqlclient remains unavailable (GitHub 404). Its original error stays in the plan; only this exact package/repository/path/404 is accepted by a mandatory gate. libmysqlclient and mysql-connector-cpp consumers explicitly say NOT TESTED. Other errors remain fatal. Remove the policy once the source is restored or migrated.

Design and self-review: .agents/docs/2026-10-19-xpkgindex-update-design.md. After this squash merge, the authorized plan is to merge the verified hiredis update against main and run a real main Action scan, consume its fixed plan to create an update PR, verify CI and squash merge the successful update.