build: bundle vcpkg as a git submodule, pinned to the manifest baseline

Adds vcpkg as a submodule at vcpkg/, pinned to the exact commit vcpkg.json
already declares as builtin-baseline, so the bundled checkout and the
manifest's resolved port versions can never drift apart.

cmake/voicecat-toolchain.cmake, scripts/common.sh, and
clients/apple/scripts/build-xcframework.sh now resolve vcpkg as:
VCPKG_ROOT env var (external checkout) > bundled submodule. Docs updated
to describe the new one-time setup.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -23,9 +23,9 @@ The default development preset is **`dev`** — it builds everything (server + t
 with real vcpkg deps. It works on Windows, Linux, and macOS (vcpkg triplet auto-resolved).
 
 ```bash
-# one-time vcpkg setup:
-git clone https://github.com/microsoft/vcpkg && ./vcpkg/bootstrap-vcpkg.sh  # .bat on Windows
-export VCPKG_ROOT=/path/to/vcpkg            # Linux/macOS; or $env:VCPKG_ROOT on PowerShell
+# one-time vcpkg setup (bundled as a submodule, pinned to vcpkg.json's builtin-baseline):
+git submodule update --init vcpkg
+./vcpkg/bootstrap-vcpkg.sh                  # .bat on Windows
 
 # configure + build + test:
 cmake --preset dev
@@ -33,6 +33,9 @@ cmake --build --preset dev
 ctest --preset dev                          # 21 behavior tests
 ```
 
+To use an external vcpkg checkout instead, set `VCPKG_ROOT=/path/to/vcpkg` (or
+`$env:VCPKG_ROOT` on PowerShell) — it always takes priority over the bundled submodule.
+
 Artifacts land in `build/dev/bin/` (`voicecat-server`, `vccli`, `voicecat-admin`).
 
 The `skeleton` preset (no vcpkg deps, stubs only) is a fast smoke check that needs no