Say what gets vendored, not what ends up imported

"Whatever upstream publishes as a wheel is what gets vendored" holds for the
download and reads as a claim about what runs — and there it is false.
setup_vendor_path appends common/, so for the seven packages Hermes already
ships (httpx, httpcore, h11, anyio, idna, certifi, typing_extensions) the
host's copy wins and ours never loads in-process. Only chattolib and the
compiled protobuf/websockets come from vendor/ unconditionally.

VENDORING.md explains that 30 lines further down, so the bare sentence was
wrong to anyone reading in order. Both texts now scope the claim to the
download and point at the sys.path table for the split.

VENDORING.md

@@ -94,11 +94,16 @@ PLATFORMS="linux-x86_64 linux-aarch64 macos-arm64 windows-amd64" ./vendor_chatto
 CHATTOLIB_SPEC="chattolib[realtime]==0.5.0b17" ./vendor_chattolib.sh
 ```
 
-The script passes `--only-binary :all:` — everything comes as a prebuilt wheel.
-A source distribution of `protobuf` or `websockets` could not be built for a
-*foreign* platform: uv would build it for the host and silently drop
-host-architecture binaries into `vendor/platform/<other-tag>/`. Whatever
-upstream publishes as a wheel for the pinned spec is what gets vendored.
+The script passes `--only-binary :all:` — every package is downloaded as a
+prebuilt wheel. A source distribution of `protobuf` or `websockets` could not
+be built for a *foreign* platform: uv would build it for the host and silently
+drop host-architecture binaries into `vendor/platform/<other-tag>/`.
+
+Every wheel the spec resolves to lands in `vendor/` — but see the sys.path
+order above for which of them are actually the ones that get imported.
+`chattolib` and the compiled `protobuf`/`websockets` always come from
+`vendor/`; the pure-Python packages Hermes already ships are downloaded and
+then shadowed by the host's copies wherever Hermes runs.
 
 The script wipes `vendor/`, installs the dependency tree once per platform via
 `uv pip install --python-platform …`, splits the result with `vendor_split.py`,

vendor_chattolib.sh

@@ -74,8 +74,10 @@ for tag in "${PLATFORM_LIST[@]}"; do
     echo "  → $tag ($target)"
     # --only-binary :all: for everything: a source distribution could not be
     # built for a foreign platform, and building it for the host would
-    # silently produce artifacts for the wrong architecture. Whatever upstream
-    # publishes as a wheel is what gets vendored.
+    # silently produce artifacts for the wrong architecture. Every wheel the
+    # spec resolves to is downloaded into vendor/ — which is not the same as
+    # what is imported: setup_vendor_path appends common/, so wherever Hermes
+    # already ships a package the host's copy wins (see VENDORING.md).
     uv pip install \
         --target "$BUILD_DIR/$tag" \
         --python-platform "$target" \