feat(build): qualify third-party overrides for 0.17

[wxyucs]

What changed

• resolve all 15 VSAG 0.17 third-party archive overrides through a central pin-qualified helper
• prefer branch-pinned variables, retain deprecated unversioned fallbacks, and keep upstream defaults last
• remove Alibaba Cloud OSS cache URLs while preserving authoritative upstream URLs and archive hashes
• add focused CMake coverage plus synchronized English and Chinese offline-build documentation

Validation

• make test-cmake
• loopback-mirror CMake configure with real hash verification and pinned/legacy precedence
• cmake --build build-validation-http-0.17 --target fmt cpuinfo roaring --parallel 2
• make fmt with clang-format 15
• git diff --check

Backport of the approach merged in #2679 for the 0.17-owned dependency pins and URL inventory.

Fixes: #2677

[vsag-bot]

/label status/waiting-for-review
/waiting-on reviewer
/request-review @jiaweizone

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 Require linked issue for feature/bug PRs

• body~=(?im)(?:^|[\s\-\*])(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:#\d+|[\w.\-]+/[\w.\-]+#\d+|https?://github\.com/[\w.\-]+/[\w.\-]+/issues/\d+)

[LHT129]

Reviewed the changes. The PR is well-structured and the implementation is solid:

• The VSAGThirdPartyOverride.cmake module is cleanly designed with proper input validation, collision-resistant hash prefix generation, and credential-safe diagnostics.
• All 15 third-party dependency files are consistently migrated to use vsag_resolve_thirdparty_override, with Alibaba Cloud OSS cache URLs properly removed while preserving authoritative upstream URLs and URL_HASH values.
• The test suite (thirdparty_override_test.cmake + thirdparty_override_fixture.cmake) provides thorough coverage: pinned/legacy/default precedence, credential-safe output, mismatched pin rejection, hash verification, and collision prefix extension.
• Documentation (EN + ZH) is clear and complete with lookup order, naming rules, inventory table, and practical examples.

No blocking issues found.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             0.17    #2684      +/-   ##
==========================================
- Coverage   91.94%   91.85%   -0.09%     
==========================================
  Files         320      320              
  Lines       17848    17848              
==========================================
- Hits        16410    16395      -15     
- Misses       1438     1453      +15     

Flag	Coverage Δ
cpp	91.85% <ø> (-0.09%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
common	91.75% <ø> (ø)
datacell	93.06% <ø> (-0.04%)	⬇️
index	90.96% <ø> (-0.03%)	⬇️
simd	100.00% <ø> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f966069...5002986. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.