ci/cd: vendored static OCIO everywhere, ocio-sys tracks upstream main

Policy change (supersedes the system-first probe): build OpenColorIO
from the vendored sources and link it statically on every platform
that can -- packaged binaries carry no OCIO runtime dependency. The
[patch.crates-io] ocio-sys now tracks shaloong/ocio-rs main
explicitly; its vendored yaml-cpp has the <cstdint> include that makes
the vendored build work on GCC >= 16 (verified on GCC 16.2.1).

Windows/MinGW stays the exception (the vendored source needs MSVC-only
constructs): tooling/ocio-env.sh probes the MSYS2 system OCIO there,
static when libOpenColorIO.a ships, dynamic otherwise. The Linux jobs
drop the system OCIO dev packages the system-first policy needed.

Cargo.lock

@@ -5208,7 +5208,7 @@ dependencies = [
 [[package]]
 name = "ocio-sys"
 version = "0.2.1"
-source = "git+https://github.com/shaloong/ocio-rs.git#933c65dc4e8e4e22767174f0e22b07fe7af42e07"
+source = "git+https://github.com/shaloong/ocio-rs.git?branch=main#933c65dc4e8e4e22767174f0e22b07fe7af42e07"
 dependencies = [
  "cc",
  "cmake",