Initial LinuxCNC WebAssembly workspace snapshot

vendor/downloads/README.md

@@ -0,0 +1,22 @@
+# 可复现下载缓存
+
+这里登记构建所需的外部物料。允许使用官方地址、中国大陆镜像或已验证的离线缓存；镜像只改变传输位置，不改变物料身份。
+
+每个 `artifact` 记录必须包含：
+
+```json
+{"record_type":"artifact","name":"...","version":"...","source_url":"https://...","origin_url":"https://...","sha256":"64 hex","bytes":123,"license":"SPDX-ID","mirror_kind":"official|china-mirror|local-cache"}
+```
+
+规则：
+
+- `sha256` 必须对实际缓存文件计算，不能填写网页摘要或下载时间。
+- `china-mirror` 必须同时填写可追溯的 `origin_url`；无法核对上游摘要的文件不得进入构建。
+- 同一 `name/version` 只能有一条物料记录；切换镜像但 SHA-256 不变不产生新 context。
+- 物料文件放在此目录或 CI 缓存中，发布前生成离线清单；不把未验证 CDN 内容直接纳入发布包。
+
+校验命令：
+
+```bash
+python3 scripts/validate_download_index.py
+```

vendor/downloads/index.jsonl

@@ -0,0 +1,3 @@
+{"record_type":"index","schema":"download-index.v1","policy":"mirror-allowed-checksum-required"}
+{"record_type":"artifact","name":"pyodide-lock.json","version":"0.29.4","source_url":"https://cdn.jsdelivr.net/pyodide/v0.29.4/full/pyodide-lock.json","origin_url":"https://github.com/pyodide/pyodide/releases/tag/0.29.4","sha256":"14d2c2dba101277999e17135e653d8f15389ad1437f53eae213bf0c3cdff723d","bytes":122027,"license":"MPL-2.0","mirror_kind":"official"}
+{"record_type":"artifact","name":"pyodide.js","version":"0.29.4","source_url":"https://cdn.jsdelivr.net/pyodide/v0.29.4/full/pyodide.js","origin_url":"https://github.com/pyodide/pyodide/releases/tag/0.29.4","sha256":"7be9e63eddf6bd8786a5ab71c8689c35731d187e3415fe58d7cb95423b50421a","bytes":18597,"license":"MPL-2.0","mirror_kind":"official"}