Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

docs/06-signed-its-vam-ble.md

@@ -35,8 +35,10 @@ fit together, how it was verified, and what is still open. Hardware checks still
 
 ## Firmware (obu-firmware)
 
-obu-firmware is now a port of `microbu-esp32c5/firmware` (the colleague's repository, kept beside
-this one, gitignored). vanetza-idf is taken from `microbu-esp32c5/external/vanetza-idf`. It builds
+obu-firmware is now a port of `microbu-esp32c5/firmware`: the colleague's repository, of which
+this repository keeps a copy in `microbu-esp32c5/` (their commit cf4b99f plus our V2X2MAP signature
+verification; nothing is pushed to their repository). vanetza-idf is taken from
+`microbu-esp32c5/external/vanetza-idf`. It builds
 with **ESP-IDF 6.0.2 only**: the raw-TX path uses private Wi-Fi driver structures that vanetza-idf
 pins to that version. The previous C firmware (IDF 6.1) is backed up as a full flash image in
 `firmware-backups/` (gitignored, restore command in its README.txt); its sources stay on disk,