Add MISRA C checking for generated eFMI Production Code

[jgoppert]

Context

While preparing #297, the eFMI tools-page comparison showed that other Production Code generators advertise MISRA C checking. Rumoca currently emits C99 for the galec-production eFMI target (and the shared embedded-c-galec path), compile-checks generated C, and exercises behavioral equivalence, but it does not run a MISRA C checker.

We therefore must not claim MISRA compliance in the eFMI tools listing yet.

Goal

Add a reproducible, opt-in MISRA C checking workflow for Rumoca-generated eFMI Production Code. The workflow should report actionable rule violations without implying product certification.

Design questions

• Which MISRA edition/profile should the first workflow target (for example MISRA C:2012 versus MISRA C:2023)?
• Which checker should Rumoca integrate (for example the Cppcheck MISRA add-on), and what licensing or user-supplied rule-text constraints apply?
• Should the first scope cover only galec-production, or all targets sharing the embedded-C GALEC renderer?
• How should deviations, suppressions, and generated-code baselines be reviewed and recorded?
• Should CI gate on zero findings immediately, or publish a report while the initial backlog is reduced?

Acceptance criteria

• Select and document the checker, MISRA edition/profile, and licensing prerequisites.
• Add a repository-standard cargo xtask verify ... workflow that checks C generated through the public galec-production path.
• Produce deterministic, file/line/rule diagnostics for at least one checked-in generated-code fixture.
• Cover the checker integration with an automated regression test.
• Document reviewed suppressions/deviations; do not silently discard findings.
• Document that passing the workflow is a conformance check, not safety certification.
• Update user-facing eFMI documentation and any tools-page claim only after the workflow ships and its supported scope is clear.

Evidence

• SPEC_0034 currently requires generated-C compilation and behavioral-equivalence coverage, but not MISRA checking.
• spec/archive/deferred/SPEC_0028_CERTIFICATION_CODEGEN.md records MISRA-style constraints as future work rather than an active guarantee.