feat(onboarding): use tramiton-core natively for firmware detection

Replace the `tramiton detect --json` CLI shell-out with a direct dependency on
tramiton-core (same-company IP), so firmware bare-metal/RTOS classification runs
in-process and the whole tramiton suite is available to onboarding.

- compliance-agent depends on tramiton-core (git, tag v0.4.0).
- classify/firmware.rs: TramitonNative runs tramiton_core::provider::analyze on a
  blocking thread and maps its BuildPlan → a minimal FirmwareDetection. Drops the
  mirrored JSON structs and the CLI wrapper. FirmwareDetector port + a
  deterministic MockFirmwareDetector are kept so unit tests need neither the
  tramiton sources nor a firmware tree.
- CI: enable CARGO_NET_GIT_FETCH_WITH_CLI and add a git-auth step so the runner
  can fetch the private tramiton repo. Requires a repo secret TRAMITON_FETCH_TOKEN
  (Gitea PAT with read access to sharang/tramiton).

Refs #118, #121, #135.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -13,6 +13,9 @@ env:
   # both --features server and --features web shares common crate work.
   RUSTC_WRAPPER: /usr/local/bin/sccache
   SCCACHE_DIR: /tmp/sccache
+  # compliance-agent depends on tramiton-core via git; use the system git so the
+  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -46,6 +49,18 @@ jobs:
         env:
           RUSTC_WRAPPER: ""
 
+      # compliance-agent has a git dependency on tramiton-core (a private repo on
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + a read token so the
+      # runner can fetch it. Requires a repo secret TRAMITON_FETCH_TOKEN — a
+      # Gitea PAT for a user with read access to sharang/tramiton.
+      - name: Configure git auth for private tramiton dependency
+        run: |
+          git config --global \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            "ssh://git@gitea.meghsakha.com:22222/"
+        env:
+          RUSTC_WRAPPER: ""
+
       # Format (no compilation needed)
       - name: Format
         run: cargo fmt --all --check