chore!: vendor mcap_catalog directly (de-submodule) + drop CI deploy-key machinery

The Python catalog builder was a git submodule pointing at the PRIVATE
AurynRobotics/mcap_server repo — a cross-org dependency that forced CI to carry
a read-only deploy key (MCAP_CATALOG_DEPLOY_KEY) just to check the code out,
and made a fresh clone of this repo non-self-contained. Vendor its source
directly under mcap_catalog/ so this repo is standalone.

- Removed the submodule gitlink + .gitmodules; the 47 builder files (source,
  tests, schema.sql, README/REQUIREMENTS/CLAUDE, CATALOG_CONTRACT.md) are now
  regular tracked files at the SAME paths, so every reference to
  mcap_catalog/mcap_catalog_builder in the Go server, scripts, smoke/CI harness
  and docs keeps working unchanged. Vendored at builder commit a0c3d5c (the
  single-writer lock); history flattened.
- .github/workflows/ci.yml: the builder-tests and integration jobs drop
  `submodules: true` + `ssh-key: ${{ secrets.MCAP_CATALOG_DEPLOY_KEY }}` — a
  plain checkout now has the builder. No secret to provision.
- ci-integration.sh: the "submodule not initialized" guard message updated to
  "vendored builder not found".
- test_writer_lock: the process-death subprocess derives PYTHONPATH from the
  package location instead of cwd, so the suite passes from the repo root
  (vendored) as well as from mcap_catalog/ (CI's cwd).
- gofmt: filter.go / resume_test.go / compress_test.go (stray blank lines +
  struct alignment) — the CI `unit` job's gofmt gate is now clean.
- CLAUDE.md: "the only submodule" prose updated to "vendored".

Verified: 180/180 builder pytest (from both cwds), go build ./..., gofmt clean,
SMOKE PASS (the harness invokes the vendored builder as a real subprocess).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: facontidavide

.github/workflows/ci.yml

@@ -100,33 +100,17 @@ jobs:
   builder-tests:
     # M6 §5.4: the Python mcap_catalog builder's own pytest suite (schema,
     # key-parsing round-trip, reconcile, dedup/topic-set, tag-edit IPC,
-    # atomic-publish/rebuild, ...). Needs the submodule checked out. No cloud
-    # SDKs required: the S3/GCS clients are injected/test-doubled (see
-    # mcap_catalog/CLAUDE.md's storage `Source` seam) — this job proves the
-    # builder library itself, independent of the {s3,gcs} integration legs
-    # below (which exercise it as a real subprocess against real emulators).
+    # atomic-publish/rebuild, single-writer lock, ...). The builder is now
+    # VENDORED directly in this repo (mcap_catalog/, no longer a submodule), so
+    # a plain checkout has it. No cloud SDKs required: the S3/GCS clients are
+    # injected/test-doubled (see mcap_catalog/CLAUDE.md's storage `Source`
+    # seam) — this job proves the builder library itself, independent of the
+    # {s3,gcs} integration legs below (which exercise it as a real subprocess
+    # against real emulators).
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-        with:
-          submodules: true
-          # ⚠️ FORWARD-PROVISIONING (read before activating this workflow on
-          # GitHub): mcap_catalog's .gitmodules URL is
-          # git@github.com:AurynRobotics/mcap_server.git — a PRIVATE repo in a
-          # DIFFERENT org (AurynRobotics) than this repo's org (PlotJuggler).
-          # actions/checkout's default GITHUB_TOKEN can only fetch submodules
-          # within the SAME repo/org it was minted for, so `submodules: true`
-          # alone CANNOT fetch this one. Before CI is ever activated on GitHub:
-          #   1. Create a READ-ONLY deploy key on AurynRobotics/mcap_server
-          #      (repo Settings -> Deploy keys -> Add deploy key; do NOT allow
-          #      write access).
-          #   2. Add its PRIVATE half as the `MCAP_CATALOG_DEPLOY_KEY` secret on
-          #      THIS repo (Settings -> Secrets and variables -> Actions).
-          # Without both steps this job's checkout step fails immediately (a
-          # submodule-fetch permission error), before any test runs — expected
-          # and by design until the secret is provisioned.
-          ssh-key: ${{ secrets.MCAP_CATALOG_DEPLOY_KEY }}
       - uses: actions/setup-python@v5
         with:
           python-version: "3.11"
@@ -177,21 +161,10 @@ jobs:
           --health-timeout 3s
           --health-retries 20
     steps:
+      # M6 §5.4: the ci_integration test invokes the Python builder as a real
+      # subprocess (mcap_catalog/mcap_catalog_builder), now VENDORED in this
+      # repo — a plain checkout has it (no submodule, no deploy key).
       - uses: actions/checkout@v4
-        with:
-          # M6 §5.4: the ci_integration test invokes the Python builder as a real
-          # subprocess (mcap_catalog/mcap_catalog_builder), so the submodule must
-          # actually be checked out here (unlike unit/race/seam, which never touch it).
-          submodules: true
-          # ⚠️ FORWARD-PROVISIONING (see the identical note on the builder-tests
-          # job above): mcap_catalog is a PRIVATE submodule in a DIFFERENT org
-          # (AurynRobotics) than this repo (PlotJuggler) — the default
-          # GITHUB_TOKEN cannot fetch it. A READ-ONLY deploy key on
-          # AurynRobotics/mcap_server must be created and its private half
-          # stored as the `MCAP_CATALOG_DEPLOY_KEY` secret on THIS repo BEFORE
-          # CI is activated on GitHub; until then this checkout step fails at
-          # the submodule-fetch step, by design.
-          ssh-key: ${{ secrets.MCAP_CATALOG_DEPLOY_KEY }}
       - uses: actions/setup-go@v5
         with:
           go-version: "1.23"

.gitmodules

@@ -11,8 +11,10 @@ PlotJuggler-class clients on demand.
 
 This repo (`pj-mcap-server`, a git repo on branch `main`) holds the design spec, the
 implementation plans, the commercial proposal, the **Go server + connector plugin**
-implementation, and (2026-06-22) the **vendored auryn Python catalog builder** (the
-`mcap_catalog/` submodule). **[LOCAL DECISION 2026-06-04]** The
+implementation, and (2026-06-22) the **vendored auryn Python catalog builder** (in
+`mcap_catalog/` — VENDORED directly as of 2026-07-17; formerly a submodule of
+`AurynRobotics/mcap_server`, de-submoduled so this repo is fully self-contained).
+**[LOCAL DECISION 2026-06-04]** The
 implementation code goes **in this repo**: every `pj-cloud/<path>` reference in the
 plans maps to `/home/gn/ws/PJ4_Server_Template/pj-mcap-server/<path>` (the plans were
 originally written for a separate `pj-cloud/` repo at
@@ -24,7 +26,7 @@ new repo).
 
 **The auryn catalog migration (M1–M6 incl. the full M6 tail) is DONE and pushed.** The
 production architecture is a **two-process system**: the Python **`mcap_catalog/`**
-builder (submodule) is the SOLE catalog writer (schema v3, atomic publish via temp+rename,
+builder (vendored) is the SOLE catalog writer (schema v3, atomic publish via temp+rename,
 `--tag-socket` tag-edit IPC, `--no-watch` rescan-only daemon mode) and the Go server is a
 **pure read-only catalog reader + unchanged streamer** — `catalog.OpenReadOnly` is the
 ONLY constructor, `internal/indexer/` and every catalog write API are DELETED (−2k LOC),
@@ -36,9 +38,9 @@ reads are generation-pinned). `-external-builder`/`-poll-interval` are deprecate
 and `mcap_catalog/`) is the cross-language contract — schema/IPC changes MUST update it.
 
 - **Remaining follow-ups:** `matrix.sh` migration (fail-fasts with exit 2 today; needs the
-  `jkk_dataset02` corpus machine); GitHub CI activation (needs a read-only deploy key on
-  the private `AurynRobotics/mcap_server` submodule as the `MCAP_CATALOG_DEPLOY_KEY`
-  secret, plus the push decision); the C++ facet UI (client-side `GetVocabulary` —
+  `jkk_dataset02` corpus machine); the CI `integration` legs' service containers (minio +
+  fake-gcs) fail their health checks on the GitHub runner (pre-existing infra, not a code
+  regression); the C++ facet UI (client-side `GetVocabulary` —
   `docs/catalog-vocabulary-rpc.md`); real-bucket GCE smoke (`docs/gce-deploy-smoke.md`);
   builder gaps by design: `derive_tags()` stub, GCS Pub/Sub discovery, `file_metrics`.
 - **Team rule:** technical decisions are cross-checked with a standing Codex instance
@@ -145,7 +147,7 @@ local codebases first. Do not guess SDK/plugin APIs — read the real headers.
 > `plotjuggler_sdk-cloud/`). The connector plugin builds **standalone** at
 > `plugin/toolbox_dexory_cloud/` against the SDK Conan package (**0.11.0** — built on
 > this machine 2026-07-06 from `~/ws_plotjuggler/plotjuggler_sdk-cloud`). The ONLY
-> submodule of this repo is **`mcap_catalog/`**. Prose below that mentions `PJ4/` as a
+> directory `mcap_catalog/` is VENDORED (formerly the only submodule). Prose below that mentions `PJ4/` as a
 > submodule or SDK 0.8.1 is a stale reference-reading aid — the fork/vendoring history
 > lives in `docs/history.md`. Paths below were verified 2026-06-04 on the original
 > machine (`/home/gn/...`).
@@ -407,7 +409,7 @@ in batches so the client can show already-received data while the rest downloads
 cancel-mid-stream.
 
 - **Two-process backend** (the "one static binary" property is GONE — M6):
-  - **Python `mcap_catalog` builder** (submodule; sole SQLite writer): discovers bucket
+  - **Python `mcap_catalog` builder** (vendored; sole SQLite writer): discovers bucket
     objects (S3 SQS events / rescan; `--no-watch` = rescan-only), extracts MCAP
     footer/summary metadata (1–2 range-GETs), writes the auryn schema (v3: Hive
     dimensions, topic-set dedup, `tags_effective` override layer, `catalog_failures`

CLAUDE.md

@@ -0,0 +1,21 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+*.egg-info/
+.venv/
+venv/
+
+# Catalog artifacts (regenerable; default lives at /tmp anyway)
+*.db
+*.db-wal
+*.db-shm
+
+# OS / editor
+.DS_Store
+
+# Git worktrees (kept inside the repo under .worktrees/)
+.worktrees/