Stabilize macOS CI dependency build by pinning fmt/spdlog and enforcing C++20 in workflows

[Copilot]

Pull Request

Description

CI was failing on macOS while compiling vendored fmt/spdlog under build/_deps due to incompatible format-string/consteval paths. This change aligns dependency resolution and build configuration so spdlog and fmt are consistently integrated under C++20.

• Dependency alignment
  • Pin fmt to 10.2.1
  • Pin spdlog to v1.14.1
  • Resolve fmt before spdlog in CMake fallback flow
• Single fmt integration path
  • Force spdlog to use external fmt via cache config
  • Remove bundled fmt mismatch risk during dependency compilation
• CI configure consistency
  • Pass -DCMAKE_CXX_STANDARD=20 explicitly in CI configure steps (build matrix + CodeQL build-for-analysis)

set(SPDLOG_FMT_EXTERNAL ON CACHE BOOL "Use external fmt in spdlog" FORCE)

FetchContent_Declare(fmt
  GIT_REPOSITORY https://github.com/fmtlib/fmt.git
  GIT_TAG 10.2.1)

FetchContent_Declare(spdlog
  GIT_REPOSITORY https://github.com/gabime/spdlog.git
  GIT_TAG v1.14.1)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Performance improvement
• Security enhancement
• Refactoring (no functional changes)

Areas Changed

• Core Engine (order book, execution)
• Trading Strategies
• Exchange Connectivity
• Security Infrastructure
• Performance/Benchmarks
• Documentation
• CI/CD
• Tests

Testing

• Unit tests pass locally
• Performance benchmarks run successfully
• Manual testing completed
• Security validation performed (if applicable)

Performance Impact

• No performance impact
• Performance improvement (include benchmark results)
• Potential performance regression (justify and include mitigation)

Security Considerations

• No security implications
• Security enhancement
• Requires security review

Checklist

• Code follows project style guidelines
• Self-review of the code completed
• Code is commented, particularly in hard-to-understand areas
• Corresponding changes to documentation made
• Tests added that prove the fix is effective or that the feature works
• Any dependent changes have been merged and published

Related Issues

Linked automatically by the system.

Screenshots/Benchmark Results

(If applicable, add screenshots or benchmark comparisons)

Additional Notes

Change scope is intentionally limited to top-level CMake dependency resolution and CI configure flags; no application logic paths were modified.