Vendor Cordis framework packages as source

cordis 4.0.0-rc.6, plugin-loader, -include, -group, -timer, -hmr,
-logger-console, cosmokit 1.8.1, schemastery 3.18.0 — copied from the
cordis-workspace checkout, flattened under vendor/, original npm names,
private: true. vendor/README.md is the manifest: upstream repos +
commit SHAs, local-modification log, sync procedure.

Local modification: hmr's locale YAML imports and .i18n() call removed
(avoids a runtime YAML import hook we don't vendor).

vendor/group/README.md

@@ -0,0 +1,21 @@
+# @cordisjs/plugin-group
+
+Loader group plugin for nesting Cordis entries.
+
+## Usage
+
+```yaml
+- id: tools
+  name: '@cordisjs/plugin-group'
+  group: true
+  config:
+    - id: logger
+      name: '@cordisjs/plugin-logger-console'
+```
+
+Groups are always considered enabled themselves, but disabling a group entry
+prevents its child entries from running. Nested entry ids use `:` separators,
+for example `tools:logger`.
+
+The package re-exports the `Group` implementation from
+`@cordisjs/plugin-loader` as its default plugin.