style: format slow_move's attribute so both clang-format versions agree

PR CI's lint job failed on src/foundation/mem_override_libc.c:143-144 while the
local lint lane passed on the same file. The two run different formatters: CI
installs LLVM 20, the local lane uses the Homebrew build, which is now 22. A
wrapped attribute is one of the few things they lay out differently, so the
wrapped form was stable locally and a violation in CI.

    __attribute__((no_builtin("memcpy", "memmove",
                              "memset"))) static void *slow_move(...)

Written on one line the declaration is 117 columns, over the 100-column limit,
so it has to wrap and the two versions disagree about how. Spelling the
attribute as a macro brings the declaration to 73 columns, which leaves no
wrapping decision for either version to have an opinion about. The three
siblings below it already fit inline and are left alone.

Also repins scripts/vendored-checksums.txt for MANIFEST.md itself: the security
job's vendored-integrity layer checksums the manifest too, so editing it to
record the properties scanner patch invalidated its own entry. Produced by
scripts/security-vendored.sh --update; the one changed line is the manifest
hash, which is also the check that the earlier manual scanner.c repin was right.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

scripts/vendored-checksums.txt

@@ -5,7 +5,7 @@ c5cfb43042b6b72045f4ba997834d0a7786d2793d91680868b5815b39f14fc78  internal/cbm/v
 b29c1c9fb7cc82f58c84b376df1297d6e2737a1d655fd356db0859e3c29c2fea  internal/cbm/vendored/common/tree_sitter/alloc.h
 31e60a1bff6f715afacce03b5b70efe42b58371b4f9595dd4af52a577ff9608c  internal/cbm/vendored/common/tree_sitter/array.h
 180b893c8734778fd32f372dfbc27bd6ad1cd2221f26150b31256ff6716320d2  internal/cbm/vendored/common/tree_sitter/parser.h
-00a84162eb34fb58bcdd38c08922d4fea4c87b7c2219dd64b773dd15ba18de71  internal/cbm/vendored/grammars/MANIFEST.md
+a66a04ed735fdb3d4a90ee4353b8f0490dc0360da5965b0d13ec5d6766f146fa  internal/cbm/vendored/grammars/MANIFEST.md
 ad8425038de519f8c4e3e9339feebf99dfad8a6002dcf79227d91402780a32cc  internal/cbm/vendored/grammars/ada/LICENSE
 02805ec13939b749c891567be36bf024b09034e04c80683a1ae667272458d549  internal/cbm/vendored/grammars/ada/parser.c
 115a75d000bef9c70c4de7dfbb7f2a80b90cbb14ba265056dc7abb1ef3b9b6db  internal/cbm/vendored/grammars/ada/tree_sitter/alloc.h

src/foundation/mem_override_libc.c

@@ -140,8 +140,15 @@ __attribute__((constructor(101))) static void libc_resolve(void) {
  * constructor resolves its own target once. */
 #define RESOLVED(ptr, name) ((ptr) ? (ptr) : ((ptr) = dlsym(RTLD_NEXT, name)))
 
-__attribute__((no_builtin("memcpy", "memmove",
-                          "memset"))) static void *slow_move(void *d, const void *s, size_t n) {
+/* Spelled through a macro only because the three builtin names plus this
+ * signature come to 117 columns, and a wrapped attribute is the one thing
+ * clang-format 20 and 22 lay out differently -- CI runs 20, the local lane runs
+ * Homebrew's 22, so the wrapped form passed here and failed there. Fitting the
+ * line under the 100-column limit leaves no wrapping decision to disagree on.
+ * The siblings below fit as they are and stay inline. */
+#define NO_BUILTIN_MEM __attribute__((no_builtin("memcpy", "memmove", "memset")))
+
+NO_BUILTIN_MEM static void *slow_move(void *d, const void *s, size_t n) {
     unsigned char *dd = (unsigned char *)d;
     const unsigned char *ss = (const unsigned char *)s;
     if (dd < ss) {