Correct vendoring doc claims against the vendored tree

[TheGreatAxios]

Summary: applies four verified fixes to docs/VENDORING.md (adapter line counts, npm exceptions, transitive pin, workspace membership). Docs text only; no behavior files touched.

Verification: spot-checked each claim against the tree (adapter wc, root package.json deps/devDeps/workspaces, bun.lock); pre-commit typecheck and build passed.

Fixes CL-7898

[linear-code]

CL-7898

[TheGreatAxios]

Critic review - Comment (approve-leaning, merge-ready)

Docs-only correction to docs/VENDORING.md. All four changed claims spot-check against the tree. No behavior files touched.

Verified (blocking checks - all pass)

• Adapter line counts: vendor/intx-workflow-host/adapters/substrate-mailbox-store.ts is 563 lines and substrate-mailbox-store.test.ts is 586 lines (wc -l), matching the new "source file alone is 563 lines, plus its 586-line test" wording. The old "563 lines" for both was wrong.
• package.json:89 @intx/crypto 0.3.0 under dependencies and package.json:109 @intx/inference-testing 0.3.0 under devDependencies - matches the new pin wording and the deps/devDeps split.
• @intx/inference-discovery has no direct root pin (package.json has no entry) and resolves at 0.3.0 transitively via bun.lock - matches the new "resolves transitively ... with no direct root pin" wording.
• package.json:45-58 workspaces lists each whole-package vendor/intx-* dir and omits vendor/intx-workflow-host/adapters/ - matches the new workspace-membership sentence.

Nits (non-blocking follow-ups, not merge gates)

• docs/VENDORING.md:5-6 still reads "The sole exception is @intx/tools-lsp" while this PR's own corrected paragraph now correctly names two npm exceptions (@intx/crypto + @intx/tools-lsp; src/session/commit-signer.ts:4 imports @intx/crypto). Same inaccuracy class this PR fixes; suggest a follow-up touching the intro.
• The "every @intx/* package this repo imports ... except @intx/crypto and @intx/tools-lsp" sentence is true for live src/ imports (verified: no src/ import of hub-sessions/mail-memory/workflow-host), but root package.json:91,94,101 still declares those three at 0.3.0. If they are dead declarations, a follow-up could clarify or drop them; if load-bearing, the sentence needs scope. Left as a question, not a gate.
• CL-7913 re-vendor note: no 7913/re-vendor reference exists in this repo snapshot, so no concrete conflict assessed here. This PR is text-only in one doc region; a re-vendor rewriting that region would trivially supersede it - low risk either way.

Verdict

Merge-ready. No blocking findings; nits above are follow-up material.