feat(onboarding): use tramiton-core natively for firmware detection

Replace the `tramiton detect --json` CLI shell-out with a direct dependency on
tramiton-core (same-company IP), so firmware bare-metal/RTOS classification runs
in-process and the whole tramiton suite is available to onboarding.

- compliance-agent depends on tramiton-core (git, tag v0.4.0).
- classify/firmware.rs: TramitonNative runs tramiton_core::provider::analyze on a
  blocking thread and maps its BuildPlan → a minimal FirmwareDetection. Drops the
  mirrored JSON structs and the CLI wrapper. FirmwareDetector port + a
  deterministic MockFirmwareDetector are kept so unit tests need neither the
  tramiton sources nor a firmware tree.
- CI: enable CARGO_NET_GIT_FETCH_WITH_CLI and add a git-auth step so the runner
  can fetch the private tramiton repo. Requires a repo secret TRAMITON_FETCH_TOKEN
  (Gitea PAT with read access to sharang/tramiton).

Refs #118, #121, #135.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/Cargo.toml

@@ -10,6 +10,11 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
+# Native firmware build/target detection for bare-metal & RTOS artifacts.
+# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
+# available to the onboarding classifier. NOTE: CI must be able to fetch this
+# private repo (see the git-auth step in .gitea/workflows/ci.yml).
+tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }