Install the agents toolbox

[jcant0n]

Block B of the roadmap: the repository now keeps itself current with Embree instead of waiting
for somebody to notice a release.

Installed with gh aw add EvergineTeam/Evergine.Bindings@v1, pinned to toolbox commit
ace4e8d.

What runs, and when

Workflow	Trigger
binding-updater	monthly, on demand, or an issue labelled agent:needs-regen
ci-doctor	after a failed workflow run
cpp-wrapper-porter	monthly — no-ops here, this binding has no C++ wrapper
api-gate	every pull request
toolbox-update	weekly

binding-updater is the one that answers the original need. A deterministic step fetches
the sources declared in binding.yml before the agent starts, so on a month where Embree has
published nothing the agent reads a one-line report, no-ops, and the run costs almost nothing.
When something did move it regenerates, builds, and — the interesting case — fixes the
generator if a new construct breaks it, labelling the pull request needs-human-review when it
touched generator code.

api-gate is not optional here. The agent runs the generator, not the native build, so
regenerating against a newer header leaves the old binaries in place. That reads as a purely
additive diff — new symbols, none removed — while every new symbol is missing from the
libraries the package ships. native-coherence: true makes the merge depend on every P/Invoke
actually resolving, which is the check that catches it.

The five version constants are exempted from the breaking-change verdict. The gate counts a
changed constant value as a removal on purpose, to catch a silent renumbering, but
rtcore_config.h reports Embree's own version, so VERSION, VERSION_MAJOR/MINOR/PATCH and
VERSION_STRING change on every release and would make each bump "breaking" and the verdict
worthless.

toolbox-update recompiles the agents against the current toolbox weekly. Moving the v1
tag updates nothing on its own: a repository keeps the commit it was compiled against until
something recompiles it, and nothing fails in the meantime.

Also done

• The five labels the agents' safe-outputs need: agent:binding-update, agent:needs-regen,
  agent:needs-human, agent:upstream-break, needs-human-review. Without them the outputs
  fail at labelling time.
• Checked vars.APP_CLIENT_ID and secrets.APP_PRIVATE_KEY exist at the org with visibility
  all. GITHUB_TOKEN cannot write under .github/workflows/ — that permission is App-only —
  so toolbox-update needs them. Existing is not the same as the App having access to this
  repository; the first weekly run is what will actually prove it.
• Dropped what gh aw adds for local convenience and the fleet does not commit: .vscode/,
  .github/mcp.json, .github/agents/, .github/skills/ and copilot-setup-steps.yml.
  Meshoptimizer carries only .gitattributes and .github/aw/actions-lock.json, and the
  workflows compile without the rest.

Verifying it

After merge, gh workflow run "Binding Updater". The correct outcome at v4.4.1 is a noop
with nothing opened. A real cycle can only be exercised when Embree publishes 4.4.2, or by
pointing release.current at an older tag on a branch.

[github-actions]

API gate: additive

Every symbol that existed still exists, unchanged. Nothing that compiled before stops compiling.

Target framework	Added	Removed
net10.0	+0	-0

_{Enum and constant values are part of the measured surface: a renumbering keeps compiling and sends the wrong number to the driver, so it counts as a removal.}