Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/docs/idf/evidence/btp-host-05/result.json

@@ -0,0 +1,38 @@
+{
+  "started_utc": "2026-09-13T12:28:03.712757+00:00",
+  "binary_sha256": "253600e26949f935113a0c122d0f05ab04876fae96b1711d3be28e96bbc0a6a1",
+  "config_sha256": "ffea9d920a2c0a1942af537400b745d0cbcfbff4629ce73c2f639aad8339abc9",
+  "sut_sha256": "541939c608f9d5b025e69f606c2365e04bd11f33bcc7cd53c1b518061dc98c33",
+  "sut_args": null,
+  "pool_sha256": null,
+  "expected_cases_sha256": "9a71319ec8f848fd5bb9b2ef37bc29771e7ef703a276ad61409e0af3e71eb42b",
+  "verdicts": [
+    {
+      "testcase": "TC_BTP_PGA_BV_01",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_BTP_PGB_BV_01",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_BTP_PGB_BV_02",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_BTP_PP_BV_01",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_BTP_PP_BV_02",
+      "verdict": "pass"
+    }
+  ],
+  "status": "completed",
+  "exit_code": 0,
+  "missing_cases": [],
+  "unexpected_cases": [],
+  "duplicate_cases": [],
+  "campaign_complete": true,
+  "finished_utc": "2026-09-13T12:28:24.003336+00:00"
+}