This is a place where good guidance on the way to do things is seriously lacking right now unfortunately. Some thoughts:
I would not recommend running bindgen at build time due to the libclang dependency. It sounds like bindgen might be able to bundle that in the future which would make this approach more reasonable.
Running bindgen locally and checking the generated code in is a reasonable option, but you should be aware of some things to watch out for. In particular, bindgen will generate bindings that are correct for the target you built them for, but they may not be correct for other targets. This can be a particular problem for C libraries that use platform-specific type definitions or conditional compilation. Even if you’re going to go the bindgen route, you should read over the headers of the library to make sure that they’re “well behaved”.
If you decide to go the route of manually writing the -sys crate, I highly recommend using the ctest crate to make sure that those bindings are actually correct. Every time I’ve set up ctest on a repo it’s found some issue.
Version support will depend a lot on the use case. If the library you’re wrapping is “well behaved” and the API surface simply expands over time, this is pretty straightforward. Otherwise, you’ll have to detect the version you’re building against and conditionally compile things as appropriate. rust-openssl’s setup is the most complex version of this that I’m aware of. libgit2-sys takes a different approach of supporting basically one version of the C library, and building it from source rather than tracking down whatever version’s installed on the system. This can make sense when there’s a huge variety of versions installed on various systems that aren’t ABI compatible.
The story around linkage is probably the most underspecified here. You’ll want to use pkg-config on Unices, maybe vcpkg on Windows, and then allow for overrides. Lots of libraries offer the ability to build a copy of the C library from source through either a Cargo feature or an environment variable as well.
If you’re linking against a copy of the C library that your build script built form source, you’ll want to link statically, but otherwise it can be up to the user. pkg-config-rs allows this to be configured via an environment variable, for example.