fix(ci): repin Vulkan SDK to 1.4.309.0 + runtime to v2.7.1, and guard the two pins against drift

[dfattal]

Two pieces of rot in the scaffold every new vendor display-processor repo is generated from. Anything stale here is copied into every future vendor repo, so both are fixed together.

1. Vulkan SDK pin (CI cannot pass)

LunarG serves only the ~16 newest SDK releases and deletes the installers for older ones. The template's original pin, 1.3.283.0, is now a hard 404 and broke six sibling repos on 2026-08-17 with curl failed with error code: 22 (fixed there by displayxr-demo-earthview#41, displayxr-demo-avatar#62, displayxr-demo-gaussiansplat#88, displayxr-demo-modelviewer#95, displayxr-demo-mediaplayer#48, displayxr-leia-plugin#149). The template had already been nudged to 1.3.296.0 in #2, which still resolves today but is next in line to age out.

Repinned to 1.4.309.0, with the same explanatory comment the six sibling PRs carry. The load-bearing part of that comment:

version: latest is a trap, not a fix. From SDK 1.4.313.0 onward LunarG repackaged the Windows installer, and this action's naive 7z x vulkan_sdk.exe then extracts only Bin/ — no Include/, no Lib/. The step still reports GREEN (it only runs glslangValidator --version) and the build dies much later at find_package(Vulkan).

Verified complete: 1.3.290.0, 1.4.304.0, 1.4.309.0. Verified Bin/-only: 1.4.313.2, 1.4.321.1, 1.4.335.0, 1.4.357.0 (= latest). 1.4.309.0 is the newest version that still unpacks a complete SDK.

The durable fix is to drop the LunarG action for vcpkg, as displayxr-runtime already has (vulkan-headers + vulkan-loader + glslang[tools] — immutable pins, cannot rot). Tracked in DisplayXR/displayxr-runtime#1029; the comment points there.

2. Runtime tag pin (v1.27.0 → v2.7.1)

Both runtime-tag pins move to the current runtime release, v2.7.1:

• CMakeLists.txt — DXR_RUNTIME_GIT_TAG "v1.27.0" → "v2.7.1"
• .github/workflows/build-windows.yml — the sibling runtime checkout's hardcoded ref: v1.27.0 → ref: ${{ env.RUNTIME_REF }}, with a new job-level RUNTIME_REF: v2.7.1

Notes on what deliberately did not change:

• No ABI-floor constant to update. The template reports XRT_PLUGIN_API_VERSION_CURRENT straight from the headers of whichever runtime the tag fetches (src/drv_example/example_plugin.c), so bumping the tag re-pairs the ABI by construction. This is documented next to the pin now, so a vendor doesn't go hunting for a second number.
• No Linux pin exists here. displayxr-leia-plugin deliberately keeps DXR_RUNTIME_GIT_TAG_LINUX (v2.2.0) behind its Windows pin; the template has only build-windows.yml and a single pin, so there is nothing to split and nothing was unified.
• vcpkg commit unchanged (5d90b0d5…) — it still matches the runtime's own build-windows.yml at v2.7.1.
• OpenXR loader 1.1.43 → 1.1.51, following the runtime's own CI at the pinned tag. This is a third value coupled to RUNTIME_REF, so the comment says to bump it alongside.

3. Drift guard (the reason the two pins can't rot apart again)

The old "keep these in sync" comment was advisory, and it had in fact drifted (the template pinned the same tag in two files with nothing checking them). Added the Rule-5 ABI pin self-check step, copied from displayxr-leia-plugin's proven implementation: it regexes DXR_RUNTIME_GIT_TAG out of CMakeLists.txt and hard-fails if it differs from RUNTIME_REF. Cheap, runs before anything is built, and gives every forked vendor repo the guard for free.

Because the check regexes the literal set(DXR_RUNTIME_GIT_TAG "vX.Y.Z" shape, CMakeLists.txt now carries a comment saying to keep that shape (no computed value, no variable indirection) — the same constraint the leia-plugin CMakeLists documents.

Verified before pushing

• https://sdk.lunarg.com/sdk/download/1.4.309.0/windows/vulkan_sdk.exe → 200
• openxr_loader_windows-1.1.51.zip → 200
• v2.7.1 is the current displayxr-runtime release
• runtime v2.7.1's build-windows.yml uses vcpkg commit 5d90b0d5… and OpenXR loader 1.1.51, and has no LunarG SDK step at all

Leaving CI to prove the build. Do not merge until it is green.