Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

obu-firmware/CMakeLists.txt

@@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.22)
 # obu-firmware: the ESP32-C5 half of the MicrOBU station, on the vanetza-idf C-ITS stack.
 #
 # Since 2026-09-23 this is a port of the colleague's standalone VRU station
-# (microbu-esp32c5/firmware, its own git repository beside this one and gitignored here). From it:
+# (microbu-esp32c5/firmware; a copy of that repository is kept in microbu-esp32c5/). From it:
 # BTP/GeoNetworking and the TS 103 097 security entity (vanetza-idf), the station-link message
 # layer over native USB Serial/JTAG and BLE GATT, the NVS credential store, and the C5 radio adapter.
 # Added here for this project: the raw receive path of the previous firmware (gn_unwrap.c, forwarded
@@ -14,14 +14,15 @@ cmake_minimum_required(VERSION 3.22)
 # by vanetza-idf's radio_c5.cmake and has only been validated there. The previous C firmware was
 # built with IDF 6.1; see FLASHING.md for the export script of each.
 #
-# vanetza-idf is taken from the colleague's tree rather than vendored (it is ~90 MB). Override with
-# -DVANETZA_IDF_DIR=... if it lives elsewhere.
+# vanetza-idf is taken from the colleague's tree in microbu-esp32c5/ rather than a second copy here
+# (it is ~70 MB). Override with -DVANETZA_IDF_DIR=... if it lives elsewhere.
 if(NOT VANETZA_IDF_DIR)
     set(VANETZA_IDF_DIR "${CMAKE_CURRENT_LIST_DIR}/../microbu-esp32c5/external/vanetza-idf")
 endif()
 if(NOT EXISTS "${VANETZA_IDF_DIR}/idf_component.yml")
-    message(FATAL_ERROR "vanetza-idf not found at ${VANETZA_IDF_DIR}: clone microbu-esp32c5 beside this "
-                        "repository or pass -DVANETZA_IDF_DIR=<path to external/vanetza-idf>")
+    message(FATAL_ERROR "vanetza-idf not found at ${VANETZA_IDF_DIR}: microbu-esp32c5/ is part of "
+                        "this repository; check it is complete, or pass "
+                        "-DVANETZA_IDF_DIR=<path to external/vanetza-idf>")
 endif()
 
 # Provenance guard for main/otm_tx_custom.c, copied unchanged from microbu-esp32c5/firmware/CMakeLists.txt:

obu-firmware/FLASHING.md

@@ -13,12 +13,19 @@ inherits the first's `IDF_PYTHON_ENV_PATH` and reports every Python dependency
 as unmet. Don't run `install.bat` to "fix" that - open a fresh terminal, or
 clear the state with `$env:IDF_PYTHON_ENV_PATH = $null; $env:IDF_PATH = $null`.
 
-The build also needs the colleague's `microbu-esp32c5` checkout beside this
-repository (gitignored here): vanetza-idf is taken from its
-`external/vanetza-idf`. Pass `-DVANETZA_IDF_DIR=<path>` to `idf.py` if it lives
-elsewhere. The first build downloads `espressif/esp-boost` into
+The build also needs the colleague's `microbu-esp32c5` tree, which this
+repository carries as ordinary files in `microbu-esp32c5/`: vanetza-idf is taken
+from its `external/vanetza-idf`. Pass `-DVANETZA_IDF_DIR=<path>` to `idf.py` if
+it lives elsewhere. The first build downloads `espressif/esp-boost` into
 `managed_components/`.
 
+`microbu-esp32c5/` is a copy, not a submodule: nothing is fetched from or pushed
+to the colleague's repository (HAW GitLab, urban-mobility-lab/microbu/
+microbu-esp32c5). It was taken at their commit cf4b99f plus our V2X2MAP
+signature verification (local commit 428a386; that repository's history is kept
+outside this one in `..\microbu-esp32c5-colleague.git`). To take a newer version
+of their tree, copy it over this folder, rebuild and test, and commit it here.
+
 ## Every new PowerShell session
 
 ```powershell

obu-firmware/NOTES.md

@@ -3,7 +3,7 @@
 ## Since 2026-09-23: signed ITS on vanetza-idf
 
 This firmware is a port of the colleague's standalone ESP32-C5 VRU station
-(`microbu-esp32c5/firmware`, its own git repository kept beside this one and gitignored here).
+(`microbu-esp32c5/firmware`; a copy of that repository is kept in `microbu-esp32c5/`).
 From it: the vanetza-idf C-ITS stack (BTP, GeoNetworking, the TS 103 097 security entity with
 credentials in NVS), the station-link protocol v1 (`link_protocol.*`, `link_service.*`) over the
 native USB port (`serial_link.*`, frame type 0x10 in the same 0xAA55 framing as before) and over BLE