Support LIBNEO_BRANCH override for the libneo dependency

[krystophny]

Implements KAMEL's side of libneo's per-PR reverse-dependency gate dispatch contract (itpplasma/libneo#278), and makes dependency fetching hermetic.

The gate dispatches ci.yml with -f libneo_ref=<sha> and, for full runs, -f full=true.

The libneo ref is now controlled exclusively by the cmake cache option -DLIBNEO_REF=<branch|tag|sha>. Ambient shell environment variables no longer affect which libneo ref is fetched, nor whether a local source tree is used. By default all FetchContent-managed dependencies (libneo included) are fetched; the only local-source override is the explicit -D<DEP>_PATH=<dir> cache variable.

Changes:

• cmake/Util.cmake: remove $ENV{LIBNEO_BRANCH} read; check cache variable ${DEP_UPPER}_REF instead. Add ${DEP_UPPER}_PATH cache variable support for local-source overrides. Remove the $ENV{CODE}/<dep> FetchContent bypass entirely, so find_or_fetch defaults to fetching. Rename LIBNEO_BRANCH to LIBNEO_REF throughout.
• .github/workflows/ci.yml: remove top-level env: LIBNEO_BRANCH: block; pass -DLIBNEO_REF=${{ inputs.libneo_ref }} explicitly in the Configure CMake step when libneo_ref is non-empty.
• Makefile: unexport LIBNEO_REF LIBNEO_BRANCH LIBNEO_PATH to block make's auto-import of those env vars; forward explicitly-passed LIBNEO_REF/LIBNEO_PATH make variables as -D flags on the cmake invocation.
• README.md: document -DLIBNEO_REF=<ref> and -DLIBNEO_PATH=<dir> overrides.

Gate contract preserved: a dispatched run without full=true runs only the fast ctest set (-LE golden_record); push, PR, and full=true run the complete suite.

Verification

$ENV{LIBNEO_BRANCH}, $ENV{LIBNEO_REF}, and $ENV{CODE} reads removed from helper:

$ rg -i '\$ENV\{LIBNEO|\$ENV\{CODE' cmake/Util.cmake
(no output)

No $ENV{CODE} remains in tracked cmake sources (build dirs and the gitignored golden-record clone excluded):

$ rg -n -i '\$ENV\{CODE\}' --glob '!build/**' --glob '!**/build/**' --glob '!**/main_ref/**' .
(no output)

Hermetic by default: with CODE set in the environment and a real libneo checkout present at $CODE/libneo, libneo is still fetched, not taken from the local tree:

$ CODE=$HOME/code cmake -S . -B /tmp/kamel-cfgcheck -G Ninja 2>&1 | grep -i 'using libneo'
-- Using libneo ref main from https://github.com/itpplasma/libneo.git

(The previous behavior printed Using libneo in $CODE/libneo and skipped the fetch.)

Cache option is stored and used during fetch:

$ cmake -S . -B /tmp/t2 -DLIBNEO_REF=candidate-branch 2>&1 | grep LIBNEO_REF
    LIBNEO_REF
$ grep LIBNEO_REF /tmp/t2/CMakeCache.txt
LIBNEO_REF:UNINITIALIZED=candidate-branch

Note: test/ql-balance/golden_record/main_ref/cmake/Util.cmake is a gitignored clone of KAMEL main generated by ensure_golden.py; it is refreshed from the remote main branch and inherits this fix once merged.

Tracking itpplasma/code#55, consumed by itpplasma/libneo#278.

[krystophny]

@marjohma heads-up: this PR is part of a cross-repo change unifying how the codes resolve libneo (a validated LIBNEO_REF override and tracking the release/26.2 branch by default), plus an external CI trigger so the libneo release gate can build this code against a candidate ref. It needed a few more changes than expected, so your feedback would be valuable before it lands. We plan to merge the whole set on Monday, 2026-06-15. Companion CI PR: #133.