Modernize C builds with offline dependencies and portable runtime helpers

[madeye]

Build this C11 project from a checkout or release archive using a compiler and CMake, without fetching submodules or installing third-party development packages. Default bundled mode uses pinned source archives; explicit system mode remains available for distribution packaging.

• Remove libcork/libipset and the bloom submodule. Add bounded IPv4/IPv6 prefix storage and portable socket, process and clock helpers while preserving the CLI and public embedding API.
• Separate executable, static-library and shared-library builds with relocatable installation metadata. The minimal profile omits regex, plugins, manager and legacy stream ciphers; Mbed TLS builds only the required crypto primitives.
• Use Clang for the static build matrix. The Docker build produces fully static Linux/musl executables; native macOS and Windows jobs reject third-party dynamic dependencies, exercise installed programs and consumers, and publish tested artifacts. macOS and Windows retain their system libraries.
• Fix truncated large UDP datagrams and uninitialized null-URI output found during validation. Add real TCP/UDP interoperability, SIP003 forwarding/child cleanup, and asynchronous DNS cancellation tests.

Validation for the published head (8d504e6):

• All 21 hosted checks pass, including Linux x86-64/ARM64, macOS, FreeBSD, native Windows UCRT64, Clang static builds on Linux/macOS/Windows, Debian packaging, sanitizers, Valgrind, coverage and clang-tidy.
• Full bundled builds pass 31 unit/vendor tests; minimal builds pass 29. Windows programs and installed consumers run with toolchain DLL directories excluded from PATH.
• Six AEAD methods interoperate with shadowsocks-rust in both directions, including concurrent 1 MiB TCP streams and UDP payloads up to 4 KiB. Relocated static/shared consumers link and run.
• Linux/musl builds and tests the release archive with networking and Python discovery disabled. Clang-tidy permits zero warnings, and project compiler warnings are errors.

See docs/modernization.md for build and platform details and docs/performance.md for reproducible size, RSS and throughput measurements. The recorded loopback benchmark includes up to 22% lower observed UDP echo rates; this change does not claim a throughput improvement. Native MSVC remains unsupported.

Pending follow-up, not included in the published head: the bundled libuv migration for Windows IOCP/macOS kqueue, expanded asynchronous runtime DNS coverage, the selected shadowsocks-uv project name, and the dedicated actionlint/Ruff job with stricter clang-tidy failure handling. The current local changes pass 35 tests, actionlint, Ruff and Homebrew LLVM clang-tidy with zero findings; those results do not replace hosted validation of a future push.