the vendoring machinery: one command reproduces the whole state

scripts/vendor.sh clones upstream, rewrites @/ imports to relative
paths, and applies scripts/apply-host.py. web/host.ts is ours and gets
placed into the vendored tree, because upstream declined it.

a script rather than a .patch, and that is not a preference. between
cfde698 and 5c83ac6 — one day — upstream changed an import line,
re-indented the component from 6 spaces to 8, and added an editAccess
guard. a context diff fails on all three, none of which concern us. so
every anchor matches structure with flexible whitespace and re-indents
to whatever it finds, and a missing anchor stops the run loudly.

all three prompt-export paths are wired, which is what upstream said a
complete version needs. the other two clipboard writes are ShareMenu's
share-link and ask-an-AI blurb, and the reason they are excluded is
written down so the count does not read as the same oversight twice.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/vendor.sh

@@ -72,6 +72,10 @@ for root, _, files in os.walk(dest):
             open(path, "w", encoding="utf-8").write(out)
 PY
 
+# Officer's own changes to the vendored code. Kept OUT of this script so the copy above is exactly
+# upstream, and applied here so one command reproduces the whole state.
+python3 "$HERE/scripts/apply-host.py"
+
 cat > "$DEST/PROVENANCE.md" <<PROV
 # Vendored from lnkiai/m3e-canvas