refactor: remove vendored C libs, delete fake git/make reimplementations

- Delete 477K lines of vendored C source (sqlite3, zlib, minizip, cJSON, libcurl)
- Delete Ralph's clean-room git.c (2925 lines) and make.c (1864 lines)
  which violated Tool Integration Policy
- Delete git.test.ts, git-remote.test.ts, make.test.ts (tests for fake impls)
- Push modified libcurl (with WASI patches) to rivet-dev/secure-exec-curl
- Add fetch-libs Makefile target to download libs at build time:
  - sqlite3 from sqlite.org
  - zlib from GitHub
  - cJSON from GitHub
  - libcurl from rivet-dev/secure-exec-curl
- Add C Library Vendoring Policy to CLAUDE.md
- Mark git/make stories (US-083–085, US-090–095) as passes:false in prd.json
- libs/ and .cache/ added to .gitignore

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: NathanFlurry

CLAUDE.md

@@ -40,6 +40,15 @@
 - if the upstream cannot compile or link for the target, document the specific blockers and leave the story as failing — do not mark it passing with a placeholder
 - the PRD and story notes define which upstream project to use; follow them exactly unless explicitly told otherwise
 
+## C Library Vendoring Policy
+
+- NEVER commit third-party C library source code directly into this repo
+- **unmodified upstream libraries** (sqlite3, zlib, minizip, cJSON, etc.) must be downloaded at build time from their official release URLs — add a Makefile target in `wasmvm/c/Makefile` under `fetch-libs`
+- **modified libraries** (e.g., libcurl with WASI patches) must live in a fork under the `rivet-dev` GitHub org (e.g., `rivet-dev/secure-exec-curl`) — the Makefile downloads from the fork's archive URL
+- all downloaded library sources go in `wasmvm/c/libs/` which is gitignored — they are fetched by `make fetch-libs` and cached in `wasmvm/c/.cache/`
+- when adding a new C library dependency: (1) add its download URL and Makefile target to `fetch-libs`, (2) add `libs/<name>` to the appropriate `.gitignore`, (3) if WASI modifications are needed, create a `rivet-dev/secure-exec-<name>` fork first
+- existing forks: `rivet-dev/secure-exec-curl` (libcurl with `wasi_tls.c` and `wasi_stubs.c`)
+
 ## WASM Binary
 
 - the goal for WasmVM is full POSIX compliance 1:1 — every command, syscall, and shell behavior should match a real Linux system exactly