Upstream tree-sitter grammars (e.g. tree-sitter-postgres, tree-sitter-mysql,
tree-sitter-sqlite) live here as git submodules pinned to specific commit
SHAs. Floating refs (main, version tags) are forbidden — bumps go through
the audit checklist documented in ../OWNERS.md.