ci/cd: vendored static OCIO everywhere, ocio-sys tracks upstream main

Policy change (supersedes the system-first probe): build OpenColorIO
from the vendored sources and link it statically on every platform
that can -- packaged binaries carry no OCIO runtime dependency. The
[patch.crates-io] ocio-sys now tracks shaloong/ocio-rs main
explicitly; its vendored yaml-cpp has the <cstdint> include that makes
the vendored build work on GCC >= 16 (verified on GCC 16.2.1).

Windows/MinGW stays the exception (the vendored source needs MSVC-only
constructs): tooling/ocio-env.sh probes the MSYS2 system OCIO there,
static when libOpenColorIO.a ships, dynamic otherwise. The Linux jobs
drop the system OCIO dev packages the system-first policy needed.

Cargo.toml

@@ -72,4 +72,4 @@ opt-level = 1
 # GCC >= 16; the fork carries exactly that fix (d39c509) until a fixed
 # release lands on crates.io.
 [patch.crates-io]
-ocio-sys = { git = "https://github.com/shaloong/ocio-rs.git" }
+ocio-sys = { git = "https://github.com/shaloong/ocio-rs.git", branch = "main" }