feat(library-selection): foundation + Phase 0 scaffolding for #205

Lands the Rust-native LDF-style library-selection foundation plus the
remaining Phase 0 test-support scaffolding called for in #205's plan.

## What ships

### New crates (Phases 1–3)

- `fbuild-header-scan` — `scan(&str) -> Vec<IncludeRef>` line-oriented
  C/C++ tokenizer + `walk(seeds, search_paths) -> WalkResult` BFS
  include-graph walker. 34 unit tests; quoted-first resolution,
  search-path precedence, cycle/diamond/depth-5 termination,
  deterministic sorted output.
- `fbuild-library-select` — `resolve(seeds, search_paths, libraries)`
  PlatformIO-LDF-style two-pass resolver with path-prefix attribution
  (not basename matching). 5 unit tests including the #204 regression
  guard and same-basename-disambiguation case.

### Wiring (Phase 5 partial)

- `fbuild-build/src/framework_libs.rs` now delegates to
  `fbuild-library-select`. Public API preserved
  (`resolve_framework_library_sources(libraries, project_dir, src_dir)`)
  so teensy / stm32 / avr / esp32 orchestrators consume the new
  resolver transparently. Old basename-matching helpers removed.

### Phase 0 test-support deliverables

- `fbuild-test-support::MiniFramework` — fluent TempDir builder for
  fake Teensyduino / STM32duino / Arduino trees. Discoverable by the
  existing `discover_framework_libraries`. 12 unit tests + walker /
  resolver round-trip helpers.
- `fbuild-test-support::ElfProbe` — `object`-crate wrapper exposing
  `sections()`, `symbols()`, `section_size()`, `text_data_bss_sum()`,
  `has_symbol_containing()`. Builds fixtures via `object::write` so
  no binary blobs are checked in. 9 unit tests.
- `fbuild-test-support::CompileDb` — `compile_commands.json` parser
  with shell-aware `command`/`arguments` handling, relative-path
  resolution, and `forbidden_present()` for #204 regression checks.
  11 unit tests.
- `tasks/zccache-kv-design.md` — design note for the K/V surface
  needed by Phase 4. Filed as zackees/zccache#130 (folded into the
  existing zccache-artifact crate, not a new binary).
- `ci/measure_baseline_205.py` + `tasks/baseline-205.md` (placeholder)
  — capture script for AC #1/#2/#3 baseline numbers; numeric capture
  deferred to a clean-CI run.

### Incidental fix

- `ci/env.py::find_rust_bin` now requires `cargo` to actually exist
  in candidate bin dirs and `activate()` reorders rustup ahead of any
  pre-existing chocolatey cargo, restoring the lint hook on dual-rust
  Windows hosts.

## Behaviour changes

1. Unreferenced framework libraries no longer compile (#204 root
   cause). Path-prefix attribution requires the walker to actually
   resolve an include into a library's `include_dirs`, blocking
   FNET / Snooze / RadioHead / mbedtls from a Blink sketch on
   teensyLC.
2. STM32 SPI auto-discovers (#202). The walker resolves `<SPI.h>`
   inside `Arduino_Core_STM32/libraries/SPI/src/` without manual
   allowlists.
3. Same-basename libraries no longer collide. `"foo/config.h"`
   no longer pulls in a `Bar` library whose `bar/config.h` shares a
   basename.

## Verification

- `uv run soldr cargo check --workspace --all-targets` — green.
- `uv run soldr cargo clippy --workspace --all-targets -- -D warnings`
  — green (only the pre-existing `clippy.toml` MSRV info note;
  zero lint findings).
- `uv run soldr cargo fmt --all --check` — clean.
- `RUSTDOCFLAGS="-D warnings" uv run soldr cargo doc --workspace
  --no-deps` — green (15 crate docs).
- `uv run soldr cargo test -p fbuild-header-scan -p fbuild-library-select
  -p fbuild-test-support` — 34 + 5 + 33 + 2 doctests = 74 passed,
  0 failed.

## Out of scope (tracked follow-ups)

- Phase 4 (zccache memoization) — pending zackees/zccache#130.
- Baseline numeric capture — script ready; data capture pending CI.
- Phase 6 (acceptance gates / ELF probes wired into board tests).
- Phase 7 (perf gates).
- Phase 8 (`fbuild lib-select --explain` CLI + final
  `framework_libs.rs` deletion).

Refs: #202, #204, #205,
zackees/zccache#130

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: zackees

Cargo.lock

@@ -12,6 +12,8 @@ members = [
     "crates/fbuild-cli",
     "crates/fbuild-python",
     "crates/fbuild-test-support",
+    "crates/fbuild-header-scan",
+    "crates/fbuild-library-select",
 ]
 
 [workspace.package]
@@ -57,8 +59,9 @@ async-trait = "0.1"
 dashmap = "6"
 blake3 = "1"
 mimalloc = "0.1"
-object = "0.36"
+object = { version = "0.36", default-features = false, features = ["read", "std", "elf", "write"] }
 rusqlite = { version = "0.31", features = ["bundled"] }
+shell-words = "1"
 
 # Process containment: all subprocess spawns the daemon performs (compilers,
 # esptool, qemu, simavr, node, npm, …) and any grandchildren they fork must