QVAC-23904 chore[bc]: remove the retired onnx addon from the monorepo

[RamazTs]

🎯 What problem does this PR solve?

• @qvac/onnx was the shared ONNX Runtime host: a prebuilt .bare module several addons linked against so the runtime was built once and loaded once per process. It has no consumers left.
• ocr-onnx and tts-onnx were deleted in earlier tickets, and parakeet dropped its @qvac/onnx peer dependency when it moved to GGML. No package.json, CMakeLists.txt or *.cmake in the monorepo declares @qvac/onnx, links qvac-onnx, or calls onnx_addon:: any more.
• It also carried the last ONNX Runtime vcpkg closure in the repo (manifest, override triplets, registry allowlists), which we no longer want to keep buildable and audited.

📝 How does it solve it?

• Deletes packages/onnx/ — addon binding, src/qvac-onnx/ headers, 10 C++ test files plus .onnx fixtures, CMakeLists.txt, symbols.map/exports.txt, vcpkg manifests and override triplets, README/INTEGRATION/CHANGELOG/release notes.
• Drops the package row from docs/repository-layout.md.
• Repoints the docs that referenced it:
  • docs/architecture/ADDON-FUZZING.md — only packages/translation-nmtcpp still routes re2 to the Microsoft registry, and the "except the ONNX Runtime addons (onnx, ocr-onnx)" scope carve-out is dropped, since neither package exists to except any more;
  • packages/fabric/README.md — drops the now-dead ../onnx relative link while keeping the note that fabric reuses that packaging model;
  • vcpkg-management knowledge doc — drops the onnx override-triplet bullet and the "ONNX Packages — Release-Only Triplets" section, which named only removed packages (onnx, tts-onnx, transcription-parakeet); those release-only settings now live in the shared vcpkg-overlays/triplets/.
• Leaves as historical record: shipped changelogs and release notes mentioning @qvac/onnx (packages/fabric, asr-ggml/docs/PARAKEET-CHANGELOG.md), and the ADDON-FUZZING notes about the registry's onnxruntime-pinned Abseil port, which lives in qvac-registry-vcpkg and is unaffected by this removal.

All CI unwiring — the merge-guard paths-filter key, PREBUILD_KEYS, the ci-router enumeration, the four workflows — is in #4017.

🧪 How was it tested?

• Repo-wide sweep for @qvac/onnx, packages/onnx, qvac-onnx and onnx_addon (excluding node_modules): the only remaining hits are the intentionally-preserved historical changelog/release-note lines.
• Confirmed no surviving package links ONNX Runtime: searched every package.json, CMakeLists.txt and *.cmake for @qvac/onnx / qvac-onnx / onnxruntime — all matches were inside packages/onnx itself.
• CI on this PR will only be meaningful once QVAC-23904 infra: retire onnx CI pipelines ahead of package removal #4017 is on main; the failures visible before that are the base-branch onnx pipeline running against a deleted directory, not defects in this diff.

💥 Breaking Changes

Breaking for any out-of-tree consumer that installed @qvac/onnx (public npm latest is 0.15.1) or linked its qvac-onnx CMake config. Nothing inside the monorepo is affected — there is no in-repo migration path because there is no in-repo consumer; addons needing a shared native runtime now use @qvac/fabric, which follows the same packaging pattern.

Follow-up

• npm deprecate @qvac/onnx on the published 0.15.1 (and the GPR dev/feature/tmp tags) once this lands, mirroring the ocr-onnx retirement.
• Pre-existing staleness left untouched, happy to split out: the vcpkg knowledge doc still has a "parakeet / tts-onnx" triplet bullet (the surviving directory is packages/asr-ggml/vcpkg/triplets/), docs/repository-layout.md still lists transcription-parakeet, and ADDON-FUZZING.md's addon inventory still lists transcription-parakeet — none of those directories are tracked any more.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: Member: 1

Pending reviews: Needs 1 Management or Team Lead.

[github-actions]

Workflow security (shadow mode)

zizmor found 1080 finding(s) in .github/ (highest severity: high). This check is warn-only and does not block the merge.

Findings are annotated inline on the changed files and listed in the job summary.

Reproduce locally:

pipx run zizmor==1.27.0 --offline .github/

[github-actions]

License compliance — clean

No new dependency license findings in this PR.

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[GustavoA1604]

Can just remove the stale references

[GustavoA1604]

Can just remove the references for retired packages