Vendor Cordis framework packages as source

cordis 4.0.0-rc.6, plugin-loader, -include, -group, -timer, -hmr,
-logger-console, cosmokit 1.8.1, schemastery 3.18.0 — copied from the
cordis-workspace checkout, flattened under vendor/, original npm names,
private: true. vendor/README.md is the manifest: upstream repos +
commit SHAs, local-modification log, sync procedure.

Local modification: hmr's locale YAML imports and .i18n() call removed
(avoids a runtime YAML import hook we don't vendor).

vendor/hmr/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@cordisjs/plugin-hmr",
+  "description": "Hot Module Replacement Plugin for Cordis",
+  "version": "1.0.15",
+  "private": true,
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "author": "Shigma <shigma10826@gmail.com>",
+  "license": "MIT",
+  "cordis": {
+    "services": {
+      "required": [
+        "timer"
+      ]
+    },
+    "description": {
+      "en": "Hot Module Replacement",
+      "zh": "模块热替换"
+    }
+  },
+  "peerDependencies": {
+    "@cordisjs/plugin-timer": "^1.1.2",
+    "cordis": "^4.0.0-rc.6"
+  },
+  "dependencies": {
+    "@babel/code-frame": "^7.29.0",
+    "chokidar": "^4.0.3",
+    "cosmokit": "^1.8.1",
+    "picomatch": "^4.0.3",
+    "schemastery": "^3.18.0"
+  },
+  "devDependencies": {
+    "@types/babel__code-frame": "^7.27.0",
+    "@types/picomatch": "^3.0.2"
+  }
+}