Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/CMakeLists.txt

@@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.22)
 # obu-firmware: the ESP32-C5 half of the MicrOBU station, on the vanetza-idf C-ITS stack.
 #
 # Since 2026-09-23 this is a port of the colleague's standalone VRU station
-# (microbu-esp32c5/firmware, its own git repository beside this one and gitignored here). From it:
+# (microbu-esp32c5/firmware, in their own repository, not part of this one). From it:
 # BTP/GeoNetworking and the TS 103 097 security entity (vanetza-idf), the station-link message
 # layer over native USB Serial/JTAG and BLE GATT, the NVS credential store, and the C5 radio adapter.
 # Added here for this project: the raw receive path of the previous firmware (gn_unwrap.c, forwarded
@@ -14,14 +14,16 @@ cmake_minimum_required(VERSION 3.22)
 # by vanetza-idf's radio_c5.cmake and has only been validated there. The previous C firmware was
 # built with IDF 6.1; see FLASHING.md for the export script of each.
 #
-# vanetza-idf is taken from the colleague's tree rather than vendored (it is ~90 MB). Override with
-# -DVANETZA_IDF_DIR=... if it lives elsewhere.
+# vanetza-idf lives in external/vanetza-idf, copied from the colleague's repository (their
+# external/vanetza-idf at commit cf4b99f, unchanged; see its PROVENANCE.md). Override with
+# -DVANETZA_IDF_DIR=... to build against another checkout.
 if(NOT VANETZA_IDF_DIR)
-    set(VANETZA_IDF_DIR "${CMAKE_CURRENT_LIST_DIR}/../microbu-esp32c5/external/vanetza-idf")
+    set(VANETZA_IDF_DIR "${CMAKE_CURRENT_LIST_DIR}/external/vanetza-idf")
 endif()
 if(NOT EXISTS "${VANETZA_IDF_DIR}/idf_component.yml")
-    message(FATAL_ERROR "vanetza-idf not found at ${VANETZA_IDF_DIR}: clone microbu-esp32c5 beside this "
-                        "repository or pass -DVANETZA_IDF_DIR=<path to external/vanetza-idf>")
+    message(FATAL_ERROR "vanetza-idf not found at ${VANETZA_IDF_DIR}: obu-firmware/external/vanetza-idf "
+                        "is part of this repository; check it is complete, or pass "
+                        "-DVANETZA_IDF_DIR=<path to a vanetza-idf checkout>")
 endif()
 
 # Provenance guard for main/otm_tx_custom.c, copied unchanged from microbu-esp32c5/firmware/CMakeLists.txt: