build: find core-cpp with find_package before CPMAddPackage, so packaged builds need no fetch

[Yaraslaut]

Problem

Since the move to core-cpp (#806), core-cpp is always added with CPMAddPackage, and the CPM bootstrap (cmake/CPM.cmake) always runs file(DOWNLOAD ...) for CPM.cmake itself. There is no find_package(core-cpp) first, unlike glaze, which is found first and fetched only when missing.

That makes morph awkward to package. A package manager build (vcpkg, Conan, a distro) must not reach the network during the build, and should use its own copy of every dependency. Today a vcpkg port has to:

1. download core-cpp itself and pass -DCPM_core-cpp_SOURCE=<dir> so CPMAddPackage uses it, and
2. pre-seed CPM_SOURCE_CACHE/cpm/CPM_<version>.cmake with the exact bootstrap file, so the unconditional file(DOWNLOAD) is skipped by its hash check.

Both work, but they depend on CPM internals (the cache layout and the CPM_<name>_SOURCE variable) and break silently if the pinned CPM version or cache layout changes.

Expected

The same treatment glaze gets:

find_package(core-cpp 0.5 CONFIG QUIET)
if(NOT core-cpp_FOUND)
    CPMAddPackage(NAME core-cpp ...)
endif()

and the CPM bootstrap only included when something actually needs fetching. With core-cpp installed (it already installs a core-cpp CMake package), a packaged build would then need no CPM at all.

Notes

• morphConfig.cmake already does find_dependency(core-cpp 0.5 CONFIG), so an installed core-cpp is the expected consumer shape.
• If core-cpp is found rather than built in-tree, morph's install should not try to install core-cpp again (currently CORE_CPP_INSTALL follows MORPH_INSTALL).

[Yaraslaut]

Triage: triage: valid, area: ci

Reproduced at 9d001052. I configured with tests, examples and docs off, an empty CPM cache, and the network blocked by a dead proxy:

$ https_proxy=http://127.0.0.1:9 cmake -S . -B cfg -G Ninja -DMORPH_BUILD_TESTS=OFF -DMORPH_BUILD_EXAMPLES=OFF -DCPM_SOURCE_CACHE=<empty>
CMake Error at cmake/CPM.cmake:48 (message):
  could not download the CPM.cmake bootstrap: 7;"Couldn't connect to server"
    from: https://github.com/cpm-cmake/CPM.cmake/releases/download/v0.40.8/CPM.cmake
  ...
Call Stack (most recent call first):
  CMakeLists.txt:149 (include)
-- Configuring incomplete, errors occurred!

The configure stops at include(cmake/CPM.cmake), before glaze's find_package is even reached. So the problem is broader than core-cpp: no offline configure can succeed today unless the cache is pre-seeded, whatever is installed. The glaze branch's find_package first does not help, because the bootstrap has already run by then.

Scope note (AGENTS.md). This is build configuration. Under the filing bar it would normally be fixed inside the change that needs it, such as the vcpkg port, rather than tracked. It is triaged here because it is already open. It is a small change, and doing it closes the issue.

Three things the fix has to cover that the issue does not mention:

1. The error message is wrong for morph. cmake/CPM.cmake is a copy of core-cpp's file, and its FATAL_ERROR advises "provide every dependency and set CORE_CPP_FETCH_DEPS=OFF". That option means nothing in morph's own top-level configure. Once the bootstrap is included only when something needs fetching, the message should say that.
2. Sanitizer instrumentation disappears without any error. The AF_SANITIZER block reads the CORE_CPP_TARGETS global property, which only an in-tree add_subdirectory sets. With core-cpp found as an installed package, that property is empty, so a sanitizer build would instrument none of core-cpp and still configure cleanly (AGENTS.md, "Verify rather than assert"). Either keep the fetch for sanitizer legs or fail loudly when the property is empty under AF_SANITIZER.
3. CORE_CPP_INSTALL: the issue already covers this. When core-cpp is found, morph must not try to install it, and the export keeps working because morphConfig.cmake already calls find_dependency(core-cpp 0.5 CONFIG).

What would change the verdict: an offline configure with core-cpp and glaze installed, no CPM cache, and tests off, which succeeds on master.