- Auto path: try_build_snippet_from_env now uses
  snippet_create_from_stable_config to read from application_monitoring.yaml
  instead of building JSON from DD_RUM_* env vars
- Directive path: on_datadog_rum_config seeds from stable config via
  stable_config_get_entries, with directive block values overriding
- Trim env var forwarding to only DD_RUM_ENABLED and DD_RUM_APPLICATION_ID
- Pin inject-browser-sdk to 587b071 (includes stable_config_get_entries FFI)

A transitive dependency (clap_builder 4.6.0, via libdd-library-config)
now requires the Rust 2024 edition which needs Rust 1.85+.

aws-lc-sys (transitive dep via libdd-library-config -> rustls) compiles
C code during its build script. Without sysroot flags, the linker
cannot find crtbeginS.o in the musl cross-compilation environment.

Rust_CARGO_TARGET is empty at the point corrosion_set_env_vars runs.
Use hardcoded x86_64/aarch64 target names instead — only one will
match the actual cargo build target, the other is harmlessly ignored.

aws-lc-sys build script compile+links test binaries via clang. Without
these flags, clang invokes system GNU ld which can't find crtbeginS.o
and libgcc in the musl sysroot. Using lld and compiler-rt matches the
rest of the toolchain setup.

test_env_only_config and test_partial_env_config now write
application_monitoring.yaml into the container instead of setting
DD_RUM_* env vars, matching the new stable config integration.

test_env_remote_configuration_id, test_env_disabled_overrides_env_config,
and test_env_disabled_location_override now use application_monitoring.yaml
instead of DD_RUM_* env vars. DD_RUM_ENABLED still uses env var since
it controls the enable/disable flag, not the config source.

…hared_library_for_env

# Conflicts:
#	.gitlab/build-and-test-fast.yml
#	.gitlab/common.yml
#	.gitlab/prepare-oci-package.sh
#	.gitlab/ssi-package.yml

Adds DD_RUM_REMOTE_CONFIGURATION_ID support in configuration_from_getter
so remoteConfigurationId appears in snippets created via stable config.

inject-browser-sdk gained a 3-arg snippet_create_from_stable_config
(language, debug_logs, json_overlay) that reads YAML and merges an
optional JSON overlay internally. Move both call sites to it:
- on_datadog_rum_config builds the overlay from block directives
  instead of pre-reading entries with the (now removed)
  stable_config_get_entries.
- try_build_snippet_from_env passes a NULL overlay.

Switch inject-browser-sdk back to a git submodule (deps/inject-browser-sdk),
add_subdirectory()d so its CMakeLists handles corrosion + cbindgen.
Bump build_env rust toolchain to 1.94.0 to match the SDK's rust-toolchain.

Add ngx_pcalloc stub so the catch2 unit_tests target links, and update
EXPECTED_BIG_CHONK to the SDK's new alphabetical key ordering.

These tests were originally written against DD_RUM_* environment
variables, then migrated to read from the stable-config YAML, but
their names and conf files were never updated. Rename for accuracy:

- test_env_only_config            -> test_stable_config_only
- test_partial_env_config         -> test_nginx_config_overlays_stable_config
- test_env_remote_configuration_id -> test_stable_config_remote_configuration_id
- test_env_disabled_overrides_env_config -> test_dd_rum_enabled_false_overrides_stable_config
- test_env_disabled_location_override -> test_location_off_overrides_stable_config
- rum_env_only.conf               -> rum_stable_config_only.conf
- rum_partial_env.conf            -> rum_stable_config_partial.conf
- <ENV_APP_ID> / <ENV_TOKEN> placeholders -> <STABLE_APP_ID> / <STABLE_TOKEN>

- build_env/Dockerfile: replace Unicode en-dash in `–tlsv1.2` with
  ASCII `--tlsv1.2` so curl parses the option
- src/rum/config.cpp:
  - Rename try_build_snippet_from_env to try_build_snippet_from_stable_config
    (it no longer reads env vars; the stable-config YAML is the source)
  - Drop env-fallback telemetry tag block (DD_RUM_APPLICATION_ID lookup +
    hardcoded remote_config_used:false). Telemetry tags from the snippet
    path now leave fields empty when the nginx block doesn't supply them
    instead of misreporting `false`.
  - Drop hardcoded remote_config_used:false in apply_rum_config_tags so
    stable-config-supplied remoteConfigurationId isn't mis-tagged.
  - Remove DD_RUM_APPLICATION_ID from get_environment_variable_names —
    it's no longer read.

clang-format wraps the snippet_create_from_stable_config call onto one
line; yapf wraps Path(__file__) onto multiple lines so the conf paths
fit within the line length.

system-tests builds with RUM=OFF, so the private inject-browser-sdk
submodule is not needed. Init only dd-trace-cpp and libddwaf in CI to
avoid the auth failure on the private repo. Also normalize the
inject-browser-sdk URL to a relative path for consistency with the
other submodules.

The github source is private and requires PAT/SSH auth that CI runners
don't have. The gitlab.ddbuild.io DataDog mirror is reachable via the
GitLab CI job token, so use it as the submodule URL.

parse_bool used an inline lambda over std::tolower; switch to the
existing datadog::nginx::to_lower helper from src/string_util.h.

Drop the WHAT comments on the two SDK-validation fallbacks in
make_rum_json_config — the if/else structure already conveys the
meaning ("not a number → pass as string").

Both _write_stable_config and _cleanup_stable_config had a single
caller (the new context manager); fold them in. Also use
Orchestration.nginx_replace_file for the write, which already handles
the mkdir -p $(dirname ...) heredoc pattern instead of duplicating it.

Mirrors nginx_replace_file so _stable_config no longer needs raw
subprocess/docker_compose_command/child_env plumbing for cleanup.

Restores the rum_remote_config_tag = "remote_config_used:false" default
that was lost in the env-var->stable-config migration, ensuring telemetry
never emits an empty tag value. Switches rum_language from string_view to
const char* since it is passed to a C FFI that requires null termination.
Also extracts a _read_conf test helper, refreshes stale "env vars"
comments, and restores the "exception" catch-parameter name for
codebase consistency.

- Extract add_member/add_first_as_string lambdas in make_rum_json_config
- Add make_stable_config_snippet helper to wrap Snippet unique_ptr
- Replace child_explicit/parent_explicit pair with single rum_enable_unset
- Drop redundant inline comment in reload_nginx_with_empty_config

The CI test image bakes /.venv from a snapshot of test/pyproject.toml,
refreshed only by a manual `make build-push-test-image`. New deps
(PyYAML for the RUM stable-config tests) didn't reach CI.

Switch to `uv run --project test test/bin/run.py ...` so each job
syncs test/.venv against the source pyproject.toml before running.

The coverage job inherits the same yaml-import failure: it uses the
build image (whose baked /.venv is also stale) and invokes run.py
directly. Switch the Makefile's test/test-openresty/coverage targets
to `uv run --project test` so they sync against the source pyproject.toml,
matching the pattern just applied to .gitlab/common.yml.