Register libccd and tg as submodules instead of stray directories

Both were sitting in deps/ untracked, with dangling .git pointer files into
.git/modules/{libccd,tg} and no .gitmodules entry at all. A clean clone of this
repository got neither, and `git submodule update` had nothing to update. tg's
worktree had also been emptied -- all 95 files staged as deletions inside its
own index -- so the directory held nothing but the pointer.

Both are now real submodules, pinned by SHA and checked against the tag:

  deps/libccd  7931e764a19ef6b21b443376c699bbc9c6d4fba8  = v2.1
  deps/tg      823f78db7e104ad5074288b4f362f0d3ef0fb0b6  = v0.7.9

Named "deps/libccd" and "deps/tg" to match the eight entries already there,
which meant re-registering rather than adopting the existing .git/modules
directories -- those were named "libccd" and "tg" while every other module lives
under .git/modules/deps/. Both checkouts were verified pristine at their tags
first, so nothing was lost by re-cloning.

URLs are https://, which is what both remotes already pointed at. Five of the
existing eight entries use git@github.com:, which a CI checkout with no SSH key
cannot use; that is not this commit's problem and is left alone.

tg is wired into nothing, deliberately, and TODO.md now says so with the reason
it is kept anyway -- indexed point-in-polygon against concave polygons is the
one job GJK and MPR structurally cannot do. That entry is a deadline: either the
consumer appears or the submodule comes out.

Nothing consumes either dependency yet, so the build and the full suite are
unchanged.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

TODO.md

@@ -2386,3 +2386,32 @@ subsystem, but the ones that would actively mislead a caller are:
 - **`AGENTS.md:636`** says `sim_step()` sets `gravity_time` to `now - dt`.
   `tests/physics_sim.c` sets it to `0` and drives the step through `max_timestep`; the
   `now - dt` form was replaced because it went red under parallel `ctest`.
+
+## tg is vendored and has no consumer
+
+`deps/tg` is pinned at v0.7.9 and **nothing in the tree uses it**. It was
+evaluated alongside `deps/libccd` for the collision work and lost, for two
+reasons that are properties of the library rather than preferences:
+
+- **It is 2D permanently.** Its own documentation says the z coordinate is
+  "only carried along and serve[s] no other purpose than to be available for
+  when it's desired to export to an output representation"; no predicate reads
+  it. libccd is natively 3D, so the 2D case is a restriction that lifts later.
+- **Its predicates return `bool`.** Resolving a collision needs a minimum
+  translation vector, and `tg_geom_intersects` cannot supply one.
+
+Secondary: every coordinate in its API is `double` against libakgl's
+`float32_t`; `tg.c` is a single 16,000-line amalgamation that embeds a second
+JSON parser next to the jansson already vendored; and it ships no build system,
+so `akgl_add_vendored_dependency` would silently do nothing for it.
+
+It is kept rather than dropped because there is one job it does that libccd
+structurally cannot: **indexed point-in-polygon against concave polygons with
+holes.** GJK and MPR are convex-only, always. A trigger volume or walkable
+region authored as a concave Tiled polygon is the case, and tg answers it at
+10M+ ops/sec with its own segment index.
+
+**This entry is the deadline.** Either that consumer appears, or `deps/tg` comes
+out. A vendored dependency with no caller is a question every future reader has
+to answer, and 6 MB of it is cloned by every recursive checkout in CI. Closing
+it means either writing the region-query API or `git rm` -- not leaving it here.