chore(container-stack): convert cerro-torre/vordr/selur/rokur to submodules (#119)

## Summary
- These 4 components were folded wholesale into `container-stack/` on
2026-02-13, even though `container-stack/README.adoc` always documented
them as having their own upstream repos — that wasn't true until now.
- Extracted each with full git-filter-repo history into its own
standalone repo (`hyperpolymath/cerro-torre` #59 commits, `vordr` #47,
`selur` #44 incl. `compose/`, `rokur` #14 — net-new, had no repo
anywhere) and replaced the in-tree copy with a submodule at the same
path.
- `stapeln.toml`'s build manifest and the existing CI path filters keep
working unmodified (same directory paths).

## Changes
- `.gitmodules` added (`https://` URLs so CI checkout doesn't need a
deploy key)
- `setup.sh` now runs `git submodule update --init --recursive`
- `publish-image.yml`: checkout now fetches submodules; path filters
gained the bare submodule path (a submodule bump is a single gitlink
change, which the existing `container-stack/<name>/**` glob alone won't
catch)
- `formal-verification.yml` removed here — it was cerro-torre-specific
and has been re-added at the new `hyperpolymath/cerro-torre` repo root
instead (hyperpolymath/cerrotorre#1)
- `container-stack/README.adoc` updated to describe the submodule
reality

## Not in scope
`svalinn` is intentionally untouched — the in-tree copy and
`hyperpolymath/svalinn` have genuinely diverged (different completion %,
different files, not just staleness) and need reconciliation before
either copy is touched. Flagged inline in the README; tracked
separately.

## Test plan
- [ ] CI green on this PR (publish-image.yml should still trigger
correctly; formal-verification.yml is gone from here by design)
- [ ] `./setup.sh` on a clean clone populates
`container-stack/{cerro-torre,vordr,selur,rokur}/`

Author: hyperpolymath

.github/workflows/formal-verification.yml

@@ -14,7 +14,9 @@ on:
     branches: [main]
     paths:
       - 'container-stack/selur/**'
+      - 'container-stack/selur'
       - 'container-stack/vordr/**'
+      - 'container-stack/vordr'
       - '.github/workflows/publish-image.yml'
   workflow_dispatch: {}
 permissions:
@@ -36,6 +38,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          submodules: recursive
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - name: Log in to GHCR

.github/workflows/publish-image.yml

@@ -0,0 +1,12 @@
+[submodule "container-stack/vordr"]
+	path = container-stack/vordr
+	url = https://github.com/hyperpolymath/vordr.git
+[submodule "container-stack/selur"]
+	path = container-stack/selur
+	url = https://github.com/hyperpolymath/selur.git
+[submodule "container-stack/rokur"]
+	path = container-stack/rokur
+	url = https://github.com/hyperpolymath/rokur.git
+[submodule "container-stack/cerro-torre"]
+	path = container-stack/cerro-torre
+	url = https://github.com/hyperpolymath/cerro-torre.git

.gitmodules

@@ -1,12 +1,14 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 = container-stack/
-Embedded snapshots of the upstream container components that stapeln designs, validates,
-and orchestrates.
+Git submodules pointing at the upstream container components that stapeln designs,
+validates, and orchestrates.
 
-Each subdirectory contains the source tree for one component of the hyperpolymath
+Each subdirectory is a submodule checkout of one component of the hyperpolymath
 container stack. They exist here as context for stapeln's validation rules, security
 inspector, and gap analysis — stapeln is the *design surface* for these components,
-not a fork of them.
+not a fork of them. Until 2026-07-03 these were full copies committed directly into
+this repo (a monorepo fold-in from 2026-02-13); they are now proper submodules against
+their own standalone repos, so there is one source of truth per component.
 
 == Components
 
@@ -18,7 +20,7 @@ not a fork of them.
 | Container builder — produces cryptographically signed, minimal Chainguard-based images. Upstream repo: `hyperpolymath/cerro-torre`.
 
 | `svalinn/`
-| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`.
+| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`. *Not yet converted to a submodule* — this copy and the standalone repo have diverged (different completion state, different files) and need reconciliation before the switch; tracked separately, do not delete either copy in the meantime.
 
 | `rokur/`
 | Stapeln GUI runtime — the Stapeln GUI component itself (Tauri/Dioxus shell). Upstream repo: `hyperpolymath/rokur`.
@@ -32,7 +34,10 @@ not a fork of them.
 
 == Usage
 
-These snapshots are used by stapeln's miniKanren security engine to derive attack-surface
-rules and by the Cisco View simulation mode to model realistic component behaviour.
+`git submodule update --init --recursive` (or `./setup.sh`, which now does this for you)
+populates these directories. They are used by stapeln's miniKanren security engine to
+derive attack-surface rules and by the Cisco View simulation mode to model realistic
+component behaviour.
 
-For canonical sources, refer to the upstream repos listed above.
+For canonical sources — and to make any real change — go to the upstream repos listed
+above, not these submodule checkouts.