chore: move build output under build/ and scripts into scripts/

Layout:
- scripts/ holds the four build scripts plus the new clean.sh
- cmake/ holds mingw64-toolchain.cmake
- the scripts default to build/linux, build/macos, build/windows, build/harness
- docs/ holds the audit documents, with the round 1 task list archived

Cleanup:
- scripts/clean.sh removes generated output, with --dry-run, --staging,
  --legacy and --all, and refuses tracked, protected or outside paths
- the Windows VST3 manifest now comes from cmake/moduleinfo.json.in, so its
  version, vendor and class IDs follow cmake/Plugin.cmake instead of a
  hand-written heredoc that could drift
- deleted the unused Source/GUI/Slider, which no code constructed
- fixed the hidden double processBlock overload: three warning lines to zero
- unslopped the build scripts, the two .cjs helpers and the CMake comments
- .gitignore covers the upstream JUCE Projucer and DemoRunner binaries

Verified: five scripts pass bash -n; the harness passes CTest with zero
warning lines; the Linux VST3 and Standalone link; the Windows cross-build
passes its x86-64, runtime-import and entry-point checks; each configure
exposes only its own targets; and a full build leaves Source/ and
third_party/JUCE unchanged. The generated manifest is identical to the
previous hand-written one.

cmake/Plugin.cmake

@@ -1,14 +1,32 @@
-# ---------------------------------------------------------------------------
-# Plugin target
-# ---------------------------------------------------------------------------
-# JUCE 7.0.12 builds its VST3 manifest helper (juce_vst3_helper) with the same
-# toolchain as the plugin itself. When cross-compiling, that produces a Windows
-# .exe which cannot run on the Linux build host, so we disable the automatic
-# manifest step and inject a Windows moduleinfo.json afterwards
-# (see build_windows.sh). Native builds keep the automatic step.
+# Plugin target.
+
+# Plugin metadata. It lives here once because juce_add_plugin and the cross-build
+# VST3 manifest in cmake/moduleinfo.json.in both need the same values.
+set(SERUMALT_COMPANY_NAME "SerumAlt Audio")
+set(SERUMALT_MANUFACTURER_CODE Salt)
+set(SERUMALT_PLUGIN_CODE Sera)
+set(SERUMALT_VST3_SDK_VERSION "VST 3.7.8") # ships with the vendored JUCE 7.0.12
+
+# VST3 class IDs. Each is a fixed prefix, a per-class constant and the
+# manufacturer and plugin codes as ASCII hex, built the same way JUCE builds
+# them in juce_audio_plugin_client_VST3.cpp.
+string(HEX "${SERUMALT_MANUFACTURER_CODE}${SERUMALT_PLUGIN_CODE}" serumaltCodeHex)
+string(TOUPPER "${serumaltCodeHex}" serumaltCodeHex)
+set(SERUMALT_CID_AUDIO_MODULE "ABCDEF019182FAEB${serumaltCodeHex}")
+set(SERUMALT_CID_CONTROLLER "ABCDEF011234ABCD${serumaltCodeHex}")
+set(SERUMALT_CID_COMPATIBILITY "ABCDEF01C0DEF00D${serumaltCodeHex}")
+
+# JUCE builds its VST3 manifest helper with the target toolchain, so during a
+# Windows cross-build that helper is a Windows .exe and cannot run on the Linux
+# host. Disable the automatic step and write the manifest from the template
+# instead. Native builds keep JUCE's automatic step.
 set(SERUMALT_VST3_AUTO_MANIFEST TRUE)
 if(CMAKE_CROSSCOMPILING)
     set(SERUMALT_VST3_AUTO_MANIFEST FALSE)
+    configure_file(
+        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/moduleinfo.json.in"
+        "${CMAKE_BINARY_DIR}/moduleinfo.json"
+        @ONLY)
 endif()
 
 set(SERUMALT_FORMATS VST3)
@@ -21,14 +39,14 @@ endif()
 
 juce_add_plugin(SerumAlt
     VERSION ${PROJECT_VERSION}
-    COMPANY_NAME "SerumAlt Audio"
+    COMPANY_NAME "${SERUMALT_COMPANY_NAME}"
     IS_SYNTH TRUE
     NEEDS_MIDI_INPUT TRUE
     NEEDS_MIDI_OUTPUT FALSE
     IS_MIDI_EFFECT FALSE
     EDITOR_WANTS_KEYBOARD_FOCUS FALSE
-    PLUGIN_MANUFACTURER_CODE Salt
-    PLUGIN_CODE Sera
+    PLUGIN_MANUFACTURER_CODE ${SERUMALT_MANUFACTURER_CODE}
+    PLUGIN_CODE ${SERUMALT_PLUGIN_CODE}
     BUNDLE_ID com.serumalt.SerumAlt
     FORMATS ${SERUMALT_FORMATS}
     PRODUCT_NAME "SerumAlt"
@@ -36,14 +54,9 @@ juce_add_plugin(SerumAlt
 
 serumalt_configure_target(SerumAlt)
 
-# ---------------------------------------------------------------------------
-# MinGW cross-build: static C++/threading runtime
-# ---------------------------------------------------------------------------
-# When cross-compiling for Windows with MinGW, link libgcc / libstdc++ /
-# winpthread statically so the VST3 DLL is self-contained. Otherwise the DLL
-# imports libgcc_s_seh-1.dll, libstdc++-6.dll and libwinpthread-1.dll, none of
-# which ship with the bundle (or exist on a stock Windows host), so the host's
-# scan would fail to load the plugin. Native (Linux) builds are unaffected.
+# A MinGW cross-build must link libgcc, libstdc++ and winpthread statically.
+# A stock Windows host has none of those DLLs, so a dynamic link produces a
+# module that fails to load and disappears from the host's plugin list.
 if(MINGW)
     target_link_options(SerumAlt_VST3 PRIVATE
         -static-libgcc