port 2P step 1: vendor CPython 2.7.18 as the mtpython static library

The embedded 40250 script layer needs its own interpreter on five platforms.
2.7 is end-of-life, so nothing can be fetched from the target SDKs and the
source is vendored (official 2.7.18 tarball, trimmed to 25MB; Lib/ stays for
step 3's python27.zip).

cpython-2.7.18/CMakeLists.txt builds one `mtpython` static library from exactly
the 133 objects the reference libpython2.7.a contains, off by default behind
-DMTGODOT_EMBED_PYTHON=ON. The source list and the built-in module table
(config/config.c, 39 entries) are shared; pyconfig.h is a probe result and is
not, so each platform keeps its own under config/<platform>/, regenerated by
tools/py_embed/gen_pyconfig.sh and checked against the shared table.

Three vendor patches, documented in docs/THIRD-PARTY.md: configure/configure.ac
learn arm64 on macOS, and posixmodule.c undefines the process-control calls it
hard-defines past pyconfig.h when building for iOS.

macOS (ctest python.embed: every builtin imports, codecs and pickle work off the
vendored Lib/), Android arm64 and iOS arm64 build. Linux needs a Linux host and
Windows needs a MinGW-vs-MSVC decision; both are noted for step 4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/THIRD-PARTY.md

@@ -1,21 +1,25 @@
 # Third-party native dependencies
 
-The GDExtension links four native libraries that are **not** part of Godot or
+The GDExtension links five native libraries that are **not** part of Godot or
 godot-cpp. Phase 1 (macOS) pulled the first three from Homebrew; that stops
 working the moment we cross-compile for the Android NDK or the iOS SDK (BACKLOG
 F1/F2), so as of 2026-08-30 they are built from source as part of our own CMake
 build. Crypto++ joined later (2026-09-02) with the `MT_PROTOCOL=classic` 40250
 backend and was vendored the same way from the start.
 
-Everything lives under `extension/third_party/` and is wired by
-`extension/third_party/CMakeLists.txt`, which exposes four aliases:
+CPython joined on 2026-09-23 with 批次 2P (the embedded 40250 script layer) and is
+vendored source as well.
 
-| Alias             | Backing target   | Consumed by                  |
-|-------------------|------------------|------------------------------|
-| `mt3p::sodium`    | `sodium`         | `mtnet`, `mtpack`, `mtproto` |
-| `mt3p::zstd`      | `libzstd_static` | `mtpack`                     |
-| `mt3p::minilzo`   | `minilzo`        | `mtproto`                    |
-| `mt3p::cryptopp`  | `cryptopp`       | `mtnet` (classic backend)    |
+Everything lives under `extension/third_party/` and is wired by
+`extension/third_party/CMakeLists.txt`, which exposes five aliases:
+
+| Alias             | Backing target   | Consumed by                        |
+|-------------------|------------------|------------------------------------|
+| `mt3p::sodium`    | `sodium`         | `mtnet`, `mtpack`, `mtproto`       |
+| `mt3p::zstd`      | `libzstd_static` | `mtpack`                           |
+| `mt3p::minilzo`   | `minilzo`        | `mtproto`                          |
+| `mt3p::cryptopp`  | `cryptopp`       | `mtnet` (classic backend)          |
+| `mt3p::python`    | `mtpython`       | the script layer (`py_embed_test`) |
 
 No source file changed: `#include <sodium.h>`, `#include <zstd.h>`,
 `#include <lzo/lzo1x.h>` and `#include <cryptopp/…>` all still resolve (the LZO
@@ -90,11 +94,52 @@ one via a 1-line shim header, see below).
   (`extension/third_party/cryptopp/License.txt`). Ship-safe; unlike miniLZO it
   imposes no obligation before a public or commercial release.
 
+## CPython 2.7.18 — vendored source (not a submodule)
+
+* **Files:** `extension/third_party/cpython-2.7.18/` (~25 MB), the official
+  `Python-2.7.18.tgz` (sha256 `b62c0e7937551d0cc02b8fd5cb0f544f9405bafc9a54d3808ed4594812edef43`)
+  trimmed of what an embedded interpreter never builds or ships: `Doc Demo Tools
+  Mac PCbuild`, `Modules/{_ctypes,expat,zlib,_sqlite}`, the stdlib test trees and
+  the pre-VS2010 `PC/` project files. `Lib/` stays — batch 2P step 3 ships it as
+  `python27.zip`.
+* **Why vendored:** 2.7 is end-of-life, so there is no package to fetch on the
+  four target SDKs, and the build must keep working offline and on the
+  cross-build machines. It is the version the 40250 scripts are written for
+  (`ScriptLib` embeds 2.7), so it is pinned by the scripts, not by preference.
+* **Built by our own `cpython-2.7.18/CMakeLists.txt`**, not autotools: one
+  `mtpython` static library from the exact 133 objects the reference
+  `libpython2.7.a` contains. The source list and the built-in module table
+  (`config/config.c`, `config/Setup.static`, 39 entries) are **shared**;
+  `pyconfig.h` is **not** — it is a probe result, so each platform keeps its own
+  under `config/<platform>/`, regenerated by `tools/py_embed/gen_pyconfig.sh`.
+  Off by default: `-DMTGODOT_EMBED_PYTHON=ON` builds it.
+* **Three vendor patches** (everything else is verbatim upstream):
+  1. `configure` + 2. `configure.ac` — add `arm64) MACOSX_DEFAULT_ARCH="arm64"`
+     to both `case \`/usr/bin/arch\`` blocks; upstream predates Apple silicon and
+     dies with "Unexpected output of 'arch' on OSX".
+  3. `Modules/posixmodule.c` — after the "all other compilers" block that
+     hard-defines `HAVE_SYSTEM`/`FORK`/`EXECV`/`WAIT`/`POPEN` regardless of
+     `pyconfig.h`, undefine them again under `TARGET_OS_IPHONE`: the iphoneos SDK
+     marks `system()` unavailable and the sandbox forbids the rest.
+* **Platform notes:** Android API 24 turns off `HAVE_LANGINFO_H` (bionic declares
+  `nl_langinfo` only from API 26); iOS derives its `pyconfig.h` from the macOS one
+  (2.7's configure refuses a darwin cross build) and drops process control plus
+  `<sys/random.h>`/`getentropy`, but keeps `HAVE_GETGROUPS` because
+  `posixmodule.c` defines `MAX_GROUPS` — which its `setgroups` path needs — only
+  inside that `#ifdef`. **Windows is not built yet**: upstream supports MSVC +
+  `PC/pyconfig.h`, while our Windows gate cross-compiles with MinGW, where
+  `PC/pyconfig.h`'s gnu-win32 branch leaves `HAVE_UNISTD_H` unset and
+  `posixmodule.c` / `dynload_win.c` then collide with the MinGW headers. Decided
+  in 批次 2P step 4 (PORT-PLAN).
+* **License:** PSF License Agreement (`cpython-2.7.18/LICENSE`). Ship-safe; the
+  only obligation is keeping the license and a change notice, which this section
+  and the patched files' comments serve.
+
 ## Rebuilding / fetching
 
 `./build.sh` auto-runs `git submodule update --init --recursive` if any of the
 three submodules (godot-cpp, zstd, libsodium-cmake+libsodium) is missing.
-miniLZO and Crypto++ are vendored source and need no fetch.
+miniLZO, Crypto++ and CPython are vendored source and need no fetch.
 
 Homebrew `libsodium` / `zstd` / `lzo` are no longer referenced by the build and
 can be uninstalled.