feat(firmware): wire libgit2 component + bind git2 in system mode

Adds the extra_components metadata, git2 as an optional dep behind the
`git` feature (default-features off -> no openssl-sys/libssh2-sys), and a
git_smoke bin gated on it. libgit2-sys/libz-sys run in system mode against
fake pkg-config files (empty Libs) so they emit no link flags -- symbols
come from the esp-idf component. Proven on device: git2 version + a blob
SHA1 through the mbedTLS backend.

firmware/pkgconfig/libgit2.pc

@@ -0,0 +1,14 @@
+# Fake pkg-config file for the libgit2 esp-idf component (Spike 7, Path 2).
+#
+# libgit2-sys in system mode (LIBGIT2_NO_VENDOR=1) probes for a system libgit2
+# via pkg-config; without one it aborts, with one it emits link flags. We don't
+# want it to build OR link anything — esp-idf already builds liblibgit2.a and
+# puts it in the final link group (that's how git_smoke's 538 symbols resolved).
+# So this .pc makes the probe *succeed* (right version, in range [1.9.4,1.10.0))
+# while emitting NOTHING (empty Libs/Cflags). The symbols come from the
+# component; libgit2-sys supplies only its hand-written Rust bindings.
+Name: libgit2
+Description: libgit2 built as an esp-idf component (mbedTLS)
+Version: 1.9.4
+Libs:
+Cflags:

firmware/pkgconfig/zlib.pc

@@ -0,0 +1,16 @@
+# Fake pkg-config file for zlib (Spike 7, Path 2).
+#
+# libz-sys is a non-optional dependency of libgit2-sys. Left to itself it would
+# either grab the host (macOS) zlib or vendor-build its own libz.a — and either
+# way its zlib symbols would collide with the zlib we bundle *inside* the
+# libgit2 component (deps/zlib, which lives in esp-idf's link group where the
+# ordering is safe). This .pc makes libz-sys's probe succeed while emitting
+# NOTHING, so it contributes no symbols and the component's bundled zlib wins.
+#
+# PKG_CONFIG_LIBDIR is pointed at this directory only, so neither probe can fall
+# through to the host's real zlib.pc.
+Name: zlib
+Description: zlib bundled into the libgit2 esp-idf component
+Version: 1.3.1
+Libs:
+Cflags: