docs: add third_party/README with vendoring instructions; augment root README with crate vendoring guidance

README.md

@@ -24,3 +24,20 @@ Overte connectivity is optional; if unreachable, the client runs in offline mode
 - `--abstract=name` (legacy abstract socket attempt)
 
 Prefer using the Rust bridge.
+
+## Vendoring StardustXR crates (recommended for deep integration)
+For fuller control and inspection of the StardustXR client pipeline, clone the `asteroids` and `core` (fusion) repositories into `third_party/` and switch the bridge's `Cargo.toml` to `path` dependencies. See `third_party/README.md` for details.
+
+Benefits:
+- Deterministic builds (no moving `dev` branch)
+- Ability to patch or instrument crate internals without forking remote
+- Easier to expose new C ABI functions (input, health queries, node data extraction)
+
+After vendoring:
+```bash
+sed -i 's/git = .*/path = "..\/third_party\/asteroids"/' bridge/Cargo.toml
+sed -i 's/git = .*/path = "..\/third_party\/core"/' bridge/Cargo.toml
+cargo build -p stardust_bridge
+```
+
+If you do not vendor, please provide commit SHAs to pin; I can update `Cargo.toml` accordingly.