build : fix xcframework + cmake clean-up (#27304)

* xcframework : fix build

* mtmd : remove unused include path

* vendor : use vendor::hash alias target in cmake

CMake reserves "::" in target names for imported/alias targets, so the real
target keeps the name vendor-hash and a vendor::hash ALIAS target is added.
Consumers (mtmd, llama-gguf-hash) now link against the namespaced alias.

Assisted-by: pi:llama.cpp/Qwen3.8-27B

* vendor : add cmake targets for all vendored libs with vendor:: aliases

Add INTERFACE targets for the header-only vendor libs (miniaudio, nlohmann,
sheredom, stb) and ALIAS targets named vendor::<lib> for all of them,
including cpp-httplib and hash. Each exposes the vendor/ root so includes
are namespaced, e.g. <nlohmann/json.hpp>.

Consolidate the per-lib add_subdirectory calls into a single
add_subdirectory(vendor), keeping the cpp-httplib gate on LLAMA_BUILD_COMMON.
Consumers (llama-common, mtmd) now link the aliases instead of relying on
raw vendor/ include paths.

hash: consumers now include via "hash/hash.h"; the vendor/hash dir is kept
as a PRIVATE include so the synced upstream sources compile unmodified.

Assisted-by: pi:llama.cpp/Qwen3.8-27B

* readme : use foo/bar names in acknowledgements

Assisted-by: pi:llama.cpp/Qwen3.8-27B

* ocd : fix valign

vendor/CMakeLists.txt

@@ -0,0 +1,11 @@
+# mtmd needs these even when common is not built
+add_subdirectory(hash)
+add_subdirectory(miniaudio)
+add_subdirectory(nlohmann)
+add_subdirectory(sheredom)
+add_subdirectory(stb)
+
+# only used by common
+if (LLAMA_BUILD_COMMON)
+    add_subdirectory(cpp-httplib)
+endif()

vendor/cpp-httplib/CMakeLists.txt

@@ -9,6 +9,8 @@ set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 
 add_library(${TARGET} STATIC httplib.cpp httplib.h)
 
+add_library(vendor::cpp-httplib ALIAS ${TARGET})
+
 # disable warnings in 3rd party code
 if (CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
     target_compile_options(${TARGET} PRIVATE /w)

vendor/hash/CMakeLists.txt

@@ -16,6 +16,8 @@ add_library(${TARGET} STATIC
     ${VENDOR_SRCS}
 )
 
+add_library(vendor::hash ALIAS ${TARGET})
+
 target_compile_features(${TARGET} PRIVATE cxx_std_17)
 
 # disable warnings in 3rd party code, but keep them for hash.cpp
@@ -29,5 +31,8 @@ set_source_files_properties(${VENDOR_SRCS} PROPERTIES COMPILE_OPTIONS ${NO_WARN_
 # sha1 lives in a namespace to avoid a clash with boringssl, see scripts/sync_vendor.py
 set_source_files_properties(sha1/sha1.c PROPERTIES LANGUAGE CXX)
 
-# sha256.c includes "rotate-bits/rotate-bits.h", so consumers get this dir too
-target_include_directories(${TARGET} PUBLIC .)
+# expose the vendor/ root so consumers can include via "hash/hash.h"
+target_include_directories(${TARGET} PUBLIC ..)
+
+# internal includes of the vendored sources, e.g. sha256.c -> "rotate-bits/rotate-bits.h"
+target_include_directories(${TARGET} PRIVATE .)

vendor/miniaudio/CMakeLists.txt

@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <miniaudio/miniaudio.h>
+add_library(miniaudio INTERFACE)
+add_library(vendor::miniaudio ALIAS miniaudio)
+
+target_include_directories(miniaudio INTERFACE ..)

vendor/nlohmann/CMakeLists.txt

@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <nlohmann/json.hpp>
+add_library(nlohmann INTERFACE)
+add_library(vendor::nlohmann ALIAS nlohmann)
+
+target_include_directories(nlohmann INTERFACE ..)

vendor/sheredom/CMakeLists.txt

@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <sheredom/subprocess.h>
+add_library(sheredom INTERFACE)
+add_library(vendor::sheredom ALIAS sheredom)
+
+target_include_directories(sheredom INTERFACE ..)

vendor/stb/CMakeLists.txt

@@ -0,0 +1,6 @@
+# header-only: interface target exposing the vendor/ root so consumers
+# can include via <stb/stb_image.h>
+add_library(stb INTERFACE)
+add_library(vendor::stb ALIAS stb)
+
+target_include_directories(stb INTERFACE ..)