fix(cores): pin every remaining core to a verified upstream commit

[lepht]

Makes builds reproducible. Completes the "pin every remaining core" item in #16.

Stacked on #17. Base is fix/pin-mgba, so this shows only its own commit and can't conflict with the urgent unblock. Retargets to main when #17 merges. Merge #17 first — that one restores CI, this one is hygiene.

Why

mgba and fceumm weren't unlucky, they were first. Every core is a --depth 1 clone of third-party HEAD with a local patch applied, so any upstream edit to a patched file breaks the build with no commit here. Two had rotted already; the other 24 were one push away from the same.

What I did

For each of the 24 unpinned cores: fetched upstream HEAD, then ran git apply --check with both the tg5040 and tg5050 patches, which differ per platform.

All 24 apply cleanly at the commits pinned here. So this pins what already builds today — it moves nothing. It cannot make the current build worse than an unpinned build; it only stops it changing underneath us.

The 24 cores and their verified commits

a2600 a5200 a7800 bluemsx c128 c64 fake-08 gambatte gearcoleco gpsp handy libretro-cap32 libretro-uae mednafen_pce_fast mednafen_supafaust mednafen_vb pcsx_rearmed pet plus4 prboom race snes9x snes9x2005_plus vic

The five vice-libretro cores (c64, c128, vic, pet, plus4) share a repo and therefore a commit. Exact SHAs are in the diff.

Both makefiles still parse (make --dry-run), and every core carrying a patch now has a pin — checked programmatically, no gaps.

Limits of this verification

I confirmed the patches apply, not that the cores compile. Those are different things and only CI can settle the second. That said, the risk is bounded: these are the same commits an unpinned build would fetch right now, so a compile failure here would be a compile failure on main today too.

The trade

Cores stop drifting forward on their own. That's the point — but stale is only acceptable if bumping is easy, so #16 carries a proposed scheduled workflow that tries bumping each pin, builds what applies, and opens a PR with the ones that went green. This PR is essentially that loop run once by hand.

Cadence matters unevenly: FBNeo most (arcade romset compatibility is version-coupled and user-visible), pcsx_rearmed next (active ARM performance work), and the mature 8/16-bit cores can sit for a year without anyone noticing.