ros2_medkit_opcua: vendor open62541pp before adding to rosdistro release

[mfaferek93]

Context

ros2_medkit_opcua (added in #365) currently pulls open62541pp v0.16.0 via CMake FetchContent at configure time. This works for source builds (colcon build) and for the plugin's own CI workflow (opcua-plugin.yml), but it is incompatible with the bloom release pipeline used by rosdistro:

• Bloom builds source packages in a clean chroot with no network access
• FetchContent tries to clone from github.com at configure time → fails
• Debian release policy requires reproducible offline builds

This is why ros2_medkit_gateway vendored jwt-cpp and tl::expected as source trees inside src/vendored/ instead of using FetchContent (see feat(gateway): vendor jwt-cpp v0.7.0).

As a result, ros2_medkit_opcua is deliberately not in the rosdistro release.packages list in jazzy/distribution.yaml. Users install it from source only.

This issue tracks the work needed to make the package release-ready so it can be added to rosdistro and bloom-released alongside the rest of the medkit packages.

Scope

1. Choose vendoring layout (discussion needed):

   • Option A: vendor inside plugin package at src/ros2_medkit_plugins/ros2_medkit_opcua/src/vendored/open62541pp/ (matches jwt-cpp pattern used by gateway)
   • Option B: create a standalone src/open62541pp_vendor/ colcon package that exports the library via find_package(open62541pp_vendor) (matches ROS 2 ecosystem *_vendor pattern like nlohmann_json_vendor, yaml_cpp_vendor)

2. Strip the source tree to a manageable size:

   • Clean clone of open62541pp v0.16.0 with recursive submodules is ~127 MB
   • The biggest offender is 3rdparty/open62541/deps/ua-nodeset at 96 MB (OPC-UA information model XML files)
   • Our tank demo does not use any OPC-UA information models beyond namespace 0, so this can likely be stripped by disabling UA_ENABLE_DA, UA_ENABLE_DI, etc. and removing the XML sources
   • Target footprint after strip: ~10-15 MB

3. Replace fetchcontent_declare / fetchcontent_makeavailable in src/ros2_medkit_plugins/ros2_medkit_opcua/CMakeLists.txt with add_subdirectory(...) pointing at the vendored tree (or find_package for Option B).

4. Verify the existing tricks still work with the new layout:

   • Clearing directory-level COMPILE_OPTIONS around add_subdirectory so strict warnings do not fire on upstream C sources
   • Marking open62541pp interface includes as INTERFACE_SYSTEM_INCLUDE_DIRECTORIES so -Wsign-conversion noise does not propagate to consumers

5. Add NOTICE / license attribution for MPLv2 compliance (open62541pp and open62541 are MPLv2).

6. Update this package's README ## Third-party Dependencies section to reflect the vendored layout.

7. Add ros2_medkit_opcua (and open62541pp_vendor if Option B) to jazzy/distribution.yaml in a PR against ros/rosdistro. Bump the version: field accordingly.

Acceptance criteria

• Plugin builds in a sandboxed environment with no network access (simulate bloom)
• Unit tests still pass on the Humble / Jazzy / Rolling matrix in opcua-plugin.yml
• Docker integration suite (16 assertions) still passes
• Vendored tree is under ~20 MB
• open62541pp / open62541 LICENSE files are present and attributed in NOTICE
• rosdistro PR merged, plugin available as ros-jazzy-ros2-medkit-opcua apt package
• Humble apt package available if we also want Humble coverage

References

• PR feat(plugins): add ros2_medkit_opcua plugin #365 - initial plugin contribution (FetchContent variant)
• Gateway's jwt-cpp vendoring commit - same pattern target
• ros/rosdistro/jazzy/distribution.yaml - ros2_medkit.release.packages list