fix(core): vendor surge-core C sources

[peters]

Summary

Replace crates/surge-core/vendor with real vendored C sources instead of a symlink to ../../vendor/bsdiff.

This fixes clean-clone and release packaging cases where the symlink is not preserved, which was breaking Windows builds of surge-core and the Horizon Windows smoke.

Behavior impact

Clean Surge checkouts now contain the surge-core bsdiff, bzip2, and libdivsufsort sources directly under the crate, so:

• workspace builds no longer depend on symlink support
• cargo package -p surge-core includes the required C sources
• Windows consumers building against the tagged git repo no longer fail because vendor/3rdparty/bzip2/*.c is missing

Test evidence

• cargo package -p surge-core --allow-dirty
• ./scripts/check-version-sync.sh
• cargo fmt --all -- --check
• RUSTFLAGS='-D warnings' cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
• cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic
• dotnet format dotnet/Surge.slnx --verify-no-changes
• dotnet test dotnet/Surge.slnx --configuration Release

Motivation

The Horizon Windows Azure smoke reached the real installer/update path and then failed while compiling surge-core from the tagged Surge source because the clean checkout did not have the vendored C sources that build.rs expects. This PR fixes that upstream issue directly.