Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/docs/idf/evidence/geonetworking-host-05/result.json

@@ -0,0 +1,30 @@
+{
+  "started_utc": "2026-09-14T14:00:48.701391+00:00",
+  "binary_sha256": "a1a0b814154d332b91c0348e0609b3263d93d7a0244b8df96c427c8b697d3a8f",
+  "config_sha256": "7863a2695637b779357e393a08644048a9aa6d6009492954f6cc0ad40029dd10",
+  "sut_sha256": "0c7296b2a6190d3213545c95badd6eb37b805f814b5f912b1399b01525c78682",
+  "sut_args": null,
+  "pool_sha256": null,
+  "expected_cases_sha256": "d446bc932c6fc07477df498310010e223fb931b33aa1501602def0b89b50b977",
+  "verdicts": [
+    {
+      "testcase": "TC_GEONW_FDV_SHB_BV_01",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_GEONW_PON_FPB_BV_11_05",
+      "verdict": "inconc"
+    },
+    {
+      "testcase": "TC_GEONW_PON_SHB_BV_01",
+      "verdict": "fail"
+    }
+  ],
+  "status": "completed",
+  "exit_code": 0,
+  "missing_cases": [],
+  "unexpected_cases": [],
+  "duplicate_cases": [],
+  "campaign_complete": true,
+  "finished_utc": "2026-09-14T14:01:24.061007+00:00"
+}