[blasfeo] new port

[Joris Gillis (jgillis)]

Adds blasfeo (BLAS For Embedded Optimization, BSD-2-Clause), the dense linear algebra library used by hpipm, fatrop and acados. It is the first of a small series: the fatrop port and the casadi[fatrop] feature will follow separately (#54019 bundled everything and was closed for that reason; its CI run showed blasfeo passing on all 13 triplets, including the Windows ones).

• Version is the upstream release tag 0.1.4.3 (Apr 2026). The tag's version file still reads 0.1.4.2 — CMake derives the library version and SOVERSION from it — so the portfile writes ${VERSION} into it, giving libblasfeo.so.0.1.4.3 (SOVERSION stays 0).
• TARGET=GENERIC: the portable C kernels — the only target the build accepts with MSVC (the optimized targets are GNU-syntax assembly), and the only one that yields a cache-safe binary.
• DISABLE_PARALLEL_CONFIGURE: upstream configure_file()s include/blasfeo_target.h into the source tree, which races when the debug and release configures run concurrently.
• alloc-guard.patch: reserves a guard block in the dynamic allocators so the GENERIC kernels' 4-wide block over-read stays inside the allocation (SIGSEGV on macOS / ASan otherwise). Upstream: Over-allocate a guard block in the dynamic MAT/VEC allocators (GENERIC lib4 over-read) giaf/blasfeo#216.
• Config is exported at share/cmake/blasfeo with the unnamespaced blasfeo target, as upstream defines it.

Tested locally on x64-linux and x64-linux-dynamic, and as the dependency of fatrop and casadi's fatrop plugin on both.

• Changes comply with the maintainer guide.
• The name of the port matches an existing name for this component on https://repology.org/ if possible, and/or is strongly associated with that component on search engines.
• Optional dependencies are resolved in exactly one way. For example, if the component is built with CMake, all find_package calls are REQUIRED, are satisfied by vcpkg.json's declared dependencies, or disabled with CMAKE_DISABLE_FIND_PACKAGE_Xxx.
• The versioning scheme in vcpkg.json matches what upstream says.
• The license declaration in vcpkg.json matches what upstream says.
• The installed as the "copyright" file matches what upstream says.
• The source code of the component installed comes from an authoritative source.
• The generated "usage text" is accurate. See adding-usage for context.
• The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
• Only one version is in the new port's versions file.

🤖 Generated with Claude Code

[Billy O'Neal (BillyONeal)]

Hi there, thanks for the new port!

• alloc-guard.patch: reserves a guard block in the dynamic allocators so the GENERIC kernels' 4-wide block over-read stays inside the allocation (SIGSEGV on macOS / ASan otherwise). Upstream: Over-allocate a guard block in the dynamic MAT/VEC allocators (GENERIC lib4 over-read) giaf/blasfeo#216.

This is enough product code change that I want to see upstream take action before proceeding. Additionally, GPT 5.6 Sol reports:

ports/blasfeo/alloc-guard.patch adds padding only to blasfeo_allocate_*. Consumers using the public blasfeo_memsize_* plus blasfeo_create_* path remain exposed to out-of-bounds reads from the GENERIC kernels selected by ports/blasfeo/portfile.cmake.

Normally we give upstream 30 days to take action for patches but in this case the port isn't even in our registry yet. If there is no response in that time I think that would mean it breaks our "upstream projects should be maintained" rules. Let's see what they do.

Everything else in this PR looks mergable, thank you!

[Billy O'Neal (BillyONeal)]

I'm converting this to draft so that it stops showing up in our queries; if you see upstream fix this please press "Ready for review" so we notice