build: source rayforce from upstream at pinned SHA

[singaraiona]

Summary

• Replace the drifted (incomplete — no Makefile) vendored rayforce/ copy with an auto-clone flow pinned to a SHA in .rayforce-version.
• All make lib work now happens in OUT_DIR/rayforce-build/; source tree is never modified — required for cargo package verification to pass.
• Cargo.toml include whitelist ships vendor/rayforce/{Makefile,LICENSE,src/**,include/**} in the published .crate so end users cargo install raysense offline. CI populates vendor/ explicitly before cargo package (publish.yml).

Resolution modes (build.rs)

Mode	Triggered when	What happens
External	RAYFORCE_DIR set	Link the externally-built librayforce.a (dev mode, unchanged)
Bundled	vendor/rayforce/Makefile exists	Copy source to OUT_DIR, build there
Auto-clone	Neither	Shallow git clone upstream at the pinned SHA into OUT_DIR, build there

CFLAGS override

Upstream RELEASE_CFLAGS includes -march=native and -Werror. Both are poison for distribution: -march=native bakes the build host's CPU into the .a (crashes on older CPUs of the same arch), -Werror breaks downstream builds on new compiler warnings. build.rs overrides RELEASE_CFLAGS to a portable baseline.

Verified locally

• cargo fmt --check clean
• cargo test — 123/123 green (auto-clone path)
• cargo test — 123/123 green (bundled-vendor path simulating CI publish)
• cargo package — 167 files, 838 KiB compressed (well under the crates.io 10 MiB ceiling). Verification build passes.
• Source tree stays pristine across all three modes (no .o, no librayforce.a, no vendor/ pollution)

Test plan for reviewer

• Fresh clone, cargo build — confirm auto-clone runs and produces a working binary
• Set RAYFORCE_DIR=/abs/path/to/rayforce (with a pre-built librayforce.a) — confirm dev path links external lib
• CI publish dry-run: gh workflow run publish.yml -f dry_run=true — confirm new "Vendor rayforce at pinned SHA" step runs and cargo package --dry-run succeeds
• Bump pin: edit .rayforce-version, cargo clean -p raysense && cargo build — confirm rebuild picks up the new SHA

Out of scope / follow-ups

• Cross-platform: upstream Makefile is Linux + macOS only. Windows build path is not in this PR.
• README's "Building from source" section now says "no external setup, no submodules" — that's stale and should be updated in a follow-up (the cargo install path still works; just the docs lag).