feat(onboarding): use tramiton-core natively for firmware detection

Replace the `tramiton detect --json` CLI shell-out with a direct dependency on
tramiton-core (same-company IP), so firmware bare-metal/RTOS classification runs
in-process and the whole tramiton suite is available to onboarding.

- compliance-agent depends on tramiton-core (git, tag v0.4.0).
- classify/firmware.rs: TramitonNative runs tramiton_core::provider::analyze on a
  blocking thread and maps its BuildPlan → a minimal FirmwareDetection. Drops the
  mirrored JSON structs and the CLI wrapper. FirmwareDetector port + a
  deterministic MockFirmwareDetector are kept so unit tests need neither the
  tramiton sources nor a firmware tree.
- CI: enable CARGO_NET_GIT_FETCH_WITH_CLI and add a git-auth step so the runner
  can fetch the private tramiton repo. Requires a repo secret TRAMITON_FETCH_TOKEN
  (Gitea PAT with read access to sharang/tramiton).

Refs #118, #121, #135.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/src/classify/mod.rs

@@ -9,8 +9,7 @@ mod firmware;
 mod language;
 
 pub use firmware::{
-    FirmwareDetector, MockFirmwareDetector, TramitonBuildPlan, TramitonCli, TramitonDetect,
-    TramitonTarget,
+    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
 };
 pub use language::HeuristicClassifier;
 
@@ -23,7 +22,7 @@ use compliance_core::models::{
 };
 use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
 
-use firmware::plan_to_verdict;
+use firmware::detection_to_verdict;
 
 /// Classify a target from its artifacts and their ingested working paths, using
 /// the heuristic classifier plus the tramiton firmware detector. Verdicts are
@@ -60,8 +59,8 @@ pub async fn classify_target<D: FirmwareDetector>(
         let Some(path) = working_paths.get(&artifact.id) else {
             continue;
         };
-        if let Some(plan) = firmware_detector.detect(path).await? {
-            verdicts.push(plan_to_verdict(&plan));
+        if let Some(detection) = firmware_detector.detect(path).await? {
+            verdicts.push(detection_to_verdict(&detection));
             tramiton_used = true;
         }
     }
@@ -155,7 +154,7 @@ mod tests {
     }
 
     fn no_firmware() -> MockFirmwareDetector {
-        MockFirmwareDetector { plan: None }
+        MockFirmwareDetector { detection: None }
     }
 
     #[tokio::test]
@@ -190,12 +189,12 @@ mod tests {
         target.artifacts.push(artifact);
 
         let detector = MockFirmwareDetector {
-            plan: Some(TramitonBuildPlan {
+            detection: Some(FirmwareDetection {
                 provider: "zephyr".to_string(),
                 confidence: "high".to_string(),
                 build_system: "zephyr".to_string(),
                 framework: Some("zephyr".to_string()),
-                target: TramitonTarget {
+                target: FirmwareTarget {
                     mcu: Some("nrf52840".to_string()),
                     ..Default::default()
                 },