chore(container-stack): convert cerro-torre/vordr/selur/rokur to submodules

These 4 components were folded into container-stack/ wholesale on
2026-02-13, but container-stack/README.adoc always documented them as
having their own upstream repos (hyperpolymath/<name>) — that just
wasn't true until now. Extracted each with full git-filter-repo history
into its own standalone repo and replaced the in-tree copy with a
submodule at the same path, so stapeln.toml's build manifest and the
existing CI path filters keep working unmodified.

- .gitmodules added (https:// URLs, so CI checkout works without a
  deploy key)
- setup.sh now runs `git submodule update --init --recursive`
- publish-image.yml: checkout now fetches submodules; path filters
  gained the bare submodule path (a submodule bump is a single gitlink
  change, which the existing container-stack/<name>/** glob doesn't
  match)
- formal-verification.yml removed here — it was cerro-torre-specific
  and has been re-added at the new hyperpolymath/cerro-torre repo root
  (PR hyperpolymath/cerrotorre#1)
- container-stack/README.adoc updated to describe the submodule reality

svalinn is intentionally NOT touched here: the in-tree copy and
hyperpolymath/svalinn have genuinely diverged (different completion
state, different files, not just staleness) and need reconciliation
before either copy is touched. Flagged inline in the README.

Author: hyperpolymath

.github/workflows/formal-verification.yml

@@ -14,7 +14,9 @@ on:
     branches: [main]
     paths:
       - 'container-stack/selur/**'
+      - 'container-stack/selur'
       - 'container-stack/vordr/**'
+      - 'container-stack/vordr'
       - '.github/workflows/publish-image.yml'
   workflow_dispatch: {}
 permissions:
@@ -36,6 +38,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          submodules: recursive
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - name: Log in to GHCR

.github/workflows/publish-image.yml

@@ -0,0 +1,12 @@
+[submodule "container-stack/vordr"]
+	path = container-stack/vordr
+	url = https://github.com/hyperpolymath/vordr.git
+[submodule "container-stack/selur"]
+	path = container-stack/selur
+	url = https://github.com/hyperpolymath/selur.git
+[submodule "container-stack/rokur"]
+	path = container-stack/rokur
+	url = https://github.com/hyperpolymath/rokur.git
+[submodule "container-stack/cerro-torre"]
+	path = container-stack/cerro-torre
+	url = https://github.com/hyperpolymath/cerro-torre.git

.gitmodules

@@ -1,12 +1,14 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 = container-stack/
-Embedded snapshots of the upstream container components that stapeln designs, validates,
-and orchestrates.
+Git submodules pointing at the upstream container components that stapeln designs,
+validates, and orchestrates.
 
-Each subdirectory contains the source tree for one component of the hyperpolymath
+Each subdirectory is a submodule checkout of one component of the hyperpolymath
 container stack. They exist here as context for stapeln's validation rules, security
 inspector, and gap analysis — stapeln is the *design surface* for these components,
-not a fork of them.
+not a fork of them. Until 2026-07-03 these were full copies committed directly into
+this repo (a monorepo fold-in from 2026-02-13); they are now proper submodules against
+their own standalone repos, so there is one source of truth per component.
 
 == Components
 
@@ -18,7 +20,7 @@ not a fork of them.
 | Container builder — produces cryptographically signed, minimal Chainguard-based images. Upstream repo: `hyperpolymath/cerro-torre`.
 
 | `svalinn/`
-| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`.
+| Edge gateway — handles routing, rate-limiting, ephemeral pinholes at the network boundary. Upstream repo: `hyperpolymath/svalinn`. *Not yet converted to a submodule* — this copy and the standalone repo have diverged (different completion state, different files) and need reconciliation before the switch; tracked separately, do not delete either copy in the meantime.
 
 | `rokur/`
 | Stapeln GUI runtime — the Stapeln GUI component itself (Tauri/Dioxus shell). Upstream repo: `hyperpolymath/rokur`.
@@ -32,7 +34,10 @@ not a fork of them.
 
 == Usage
 
-These snapshots are used by stapeln's miniKanren security engine to derive attack-surface
-rules and by the Cisco View simulation mode to model realistic component behaviour.
+`git submodule update --init --recursive` (or `./setup.sh`, which now does this for you)
+populates these directories. They are used by stapeln's miniKanren security engine to
+derive attack-surface rules and by the Cisco View simulation mode to model realistic
+component behaviour.
 
-For canonical sources, refer to the upstream repos listed above.
+For canonical sources — and to make any real change — go to the upstream repos listed
+above, not these submodule checkouts.