Update XoRL submodule branches and SGLang pin

[kiddyboots216]

Summary

• Declare main as the tracked branch for xorl-client and xorl-sglang.
• Retain the xorl-client pin at 2a3a60a783c98e2a8ff722bad06dab18caee350c.
• Pin xorl-sglang to the final exact-serving PR Drop internal-only cross-references from the public tree #15 head at 1fc3396aa122e0f8eb7b1ea4fe0051250cf1bc3c.
• Replace the earlier nonexistent xorl-sglang gitlink with an object fetchable from the live sampler remote.

The parent repository continues to pin immutable commits; branch metadata only makes future submodule updates explicit.

Stack and validation

• Base: main
• Next: Add exact dense Qwen programs and shared operator improvements #43
• Head: 762205400ad0b136817c3a3f6658f39500d2ded1
• Recursive submodule checkout is clean: xorl-client resolves to 2a3a60a783c98e2a8ff722bad06dab18caee350c, and xorl-sglang resolves to 1fc3396aa122e0f8eb7b1ea4fe0051250cf1bc3c.
• Commit hooks and git diff --check passed.

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.