feat: add compat.miniaudio, spirv-reflect, nanosvg, vulkan-memory-allocator, gtl and plf-hive

[Sunrisepeak]

These six were the libraries XRGUI (Sunrisepeak/xrgui#1) still reached through
git submodules and -I flags rather than through a package manager. Packaging
them is not an mcpp-specific accommodation: xmake.lua:44 already reads

add_requires("nanosvg", "spirv-reflect", "gtl", "glfw", "miniaudio")

so the project's own primary build gets four of them from xrepo packages, and
the external/ submodules beside them are vestigial. Two are Khronos/AMD
official (SPIRV-Reflect, VulkanMemoryAllocator); the rest are widely used in
their own right.

THREE SHAPES, ONE OF THEM NEW TO THIS INDEX

A header-only + anchor TU gtl, plf-hive
B single header + GENERATED impl nanosvg, vulkan-memory-allocator
C one upstream TU is the library miniaudio, spirv-reflect

Shape B is the new one. Both are stb-style -- the implementation hides behind a
macro and upstream ships no .c to instantiate it. Leaving that to the consumer
would make the package a header drop rather than something linkable, and would
hand every consumer the same duplicate-symbol hazard, so the package generates
the TU once and both descriptors state the rule that follows: do not define the
macro again (it is a LINK error, so it surfaces late).

VMA FORCED A POLICY CHOICE, NOT JUST A SHAPE

VMA defaults to VMA_STATIC_VULKAN_FUNCTIONS 1, which references
vkBindBufferMemory2, vkGetPhysicalDeviceProperties2 and six more BY NAME.
Against a headers-only dependency that is eight undefined symbols -- observed
at link time, not predicted. Adding compat.vulkan would have made it link and
would have been wrong: it forces a Vulkan loader on every consumer of a memory
allocator and fights anyone dispatching through volk. The generated TU selects
VMA_DYNAMIC_VULKAN_FUNCTIONS instead, so VMA resolves everything through
VmaVulkanFunctions and the package needs the Vulkan headers alone.

TWO SMALLER JUDGEMENTS WORTH KEEPING

miniaudio links -ldl -lpthread -lm and deliberately NOT -lasound/-lpulse: it
dlopen()s its backends, so hard-linking them would break the package on a
machine that has neither, for no gain.

spirv-reflect exposes BOTH * and */include, because spirv_reflect.h:35-37
picks between <spirv/unified1/spirv.h> and the bundled
"./include/spirv/unified1/spirv.h". Exposing both makes the two spellings
resolve to the SAME header, so a consumer that defines
SPIRV_REFLECT_USE_SYSTEM_SPIRV_H cannot silently get a different SPIR-V
revision than this .c was written against.

VERSIONING THE UNTAGGED TWO

nanosvg and plf_hive cut no tags. Following compat.khrplatform (which mirrors
the untagged EGL-Registry), each pins a commit archive under a DATE version
from that commit's date. spirv-reflect has the opposite problem -- it tags in
lockstep with the Vulkan SDK -- so its key drops the vulkan-sdk- prefix and
lines up with compat.vulkan-headers of the same SDK.

TESTS ASSERT BEHAVIOUR, NOT LINKAGE

Every test can fail. hive checks that element ADDRESSES survive erasing their
neighbours; nanosvg checks rasterized pixel coverage is 2300-2700 for a 50x50
rect and links both halves of the generated TU so a half-instantiated package
fails there; miniaudio round-trips a sine through WAV and also checks the peak
so silence cannot pass vacuously; spirv-reflect reflects a REAL glslc-compiled
shader (embedded as words, no compiler needed on the runner) and adds a
negative case so an always-succeed stub cannot pass; VMA drives the virtual
allocator and asserts no two live allocations overlap.

VERIFIED LOCALLY

• six mcpp test runs, 1 passed / 0 failed each
• lint scripts pass on the six; cross-package refs pass across all 96
• mcpp xpkg parse passes for ALL 96 descriptors under the PINNED CI
  version 2026.8.10.3, downloaded for the purpose rather than trusting the
  newer local build -- that check is what enforces "floor first, grammar
  after"
• all six CN mirrors return 200 and are byte-identical to GLOBAL, which is
  what mirror-cn-reachable checks