Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/build-packages.yml

@@ -0,0 +1,92 @@
+name: Build Packages
+
+# Builds the seven Slackware .txz packages defined under packages/
+# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs)
+# inside a Slackware container, verifies + consolidates their checksums, and
+# uploads the result as a workflow artifact.
+#
+# Intentionally does NOT commit any built binary back to the repository —
+# packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts
+# only ever leave this workflow via the "Upload build artifacts" step below
+# (retained by GitHub Actions, not the repo) or, for tagged releases, via
+# release.yml attaching them to a GitHub Release.
+#
+# See docs/ARCHITECTURE.md section 5 (Paketmanagement).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "packages/**"
+      - "versions.env"
+      - "scripts/**"
+      - ".github/workflows/build-packages.yml"
+  pull_request:
+    paths:
+      - "packages/**"
+      - "versions.env"
+      - "scripts/**"
+      - ".github/workflows/build-packages.yml"
+  workflow_dispatch:
+    inputs:
+      packages:
+        description: >
+          Space-separated package names to build (default: all seven).
+          Example: "podman conmon"
+        required: false
+        default: ""
+  workflow_call:
+    outputs:
+      artifact-name:
+        description: "Name of the uploaded dist/ artifact"
+        value: ${{ jobs.build.outputs.artifact-name }}
+
+# Pin the Slackware build image by tag here. vbatts/slackware is a
+# long-standing, widely used Slackware Docker image; swap this (and ideally
+# pin by digest) if the project standardizes on a different/self-hosted
+# base image. See scripts/ci/setup-slackware-buildenv.sh for how missing
+# build dependencies are bootstrapped on top of whatever this image ships.
+env:
+  SLACKWARE_IMAGE: "vbatts/slackware:15.0"
+
+jobs:
+  build:
+    name: Build .txz packages
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.SLACKWARE_IMAGE }}
+    outputs:
+      artifact-name: ${{ steps.artifact-name.outputs.value }}
+    steps:
+      - name: Install git and tar (needed before actions/checkout can run)
+        run: |
+          (command -v git && command -v tar) || \
+            (echo "!! base image is missing git/tar — see SLACKWARE_IMAGE in this workflow" && exit 1)
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Slackware build environment
+        run: scripts/ci/setup-slackware-buildenv.sh
+
+      - name: Build packages
+        run: scripts/build-packages.sh ${{ github.event.inputs.packages }}
+
+      - name: Verify and consolidate checksums
+        run: scripts/checksums.sh
+
+      - name: Compute artifact name
+        id: artifact-name
+        run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.artifact-name.outputs.value }}
+          path: |
+            dist/*.txz
+            dist/*.sha256
+            dist/*.md5
+            dist/CHECKSUMS.sha256
+            dist/CHECKSUMS.md5
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/lint.yml

@@ -0,0 +1,53 @@
+name: Lint
+
+# Static analysis over shell scripts (ShellCheck) and the .plg/XML manifest
+# (xmllint) on every push and pull request. Mirrors scripts/dev/lint.sh for
+# local use.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  shellcheck:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends shellcheck
+
+      - name: Run ShellCheck
+        run: |
+          set -eu
+          # shellcheck disable=SC2038  (find | xargs is fine here, filenames
+          # in this repo never contain spaces/newlines)
+          find plugin/rc.d plugin/sbin scripts -type f \
+            \( -name '*.sh' -o -name 'rc.*' -o -name '*.SlackBuild' \) \
+            -print0 \
+          | xargs -0 shellcheck --severity=warning --external-sources
+
+  xmllint:
+    name: Validate .plg XML
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install libxml2-utils
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends libxml2-utils
+
+      - name: Validate podman.plg is well-formed XML
+        run: xmllint --noout plugin/podman.plg
+
+  editorconfig:
+    name: EditorConfig
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: editorconfig-checker/action-editorconfig-checker@main

.github/workflows/release.yml

@@ -0,0 +1,96 @@
+name: Release
+
+# Publishes a GitHub Release for a version tag (vX.Y.Z).
+#
+# By design, this workflow does NOT bump versions or modify podman.plg
+# itself — that happens locally via `scripts/release.sh <version>`, which a
+# maintainer reviews, commits, and tags *before* pushing the tag (see that
+# script's own printed instructions). This workflow's only job is to:
+#   1. Rebuild all packages from the tagged commit in a clean Slackware
+#      container (reproducibility check + provenance — we don't trust
+#      whatever a maintainer happened to have in their local dist/).
+#   2. Verify checksums match what's already committed in plugin/podman.plg
+#      at this tag (catches a release.sh run that wasn't followed by a
+#      matching commit — see the "Verify plg matches build" step).
+#   3. Create the GitHub Release and attach the .txz packages, checksum
+#      manifests, and podman.plg.
+#
+# See docs/ARCHITECTURE.md section 13 (Updates).
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build release packages
+    uses: ./.github/workflows/build-packages.yml
+
+  publish:
+    name: Publish GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download built packages
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.build.outputs.artifact-name }}
+          path: dist
+
+      - name: Re-verify checksums
+        run: scripts/checksums.sh dist
+
+      - name: Verify plugin/podman.plg matches these artifacts
+        # scripts/release.sh should already have been run locally, and its
+        # resulting podman.plg changes committed as part of this tag, before
+        # the tag was pushed. This step fails the release loudly if that
+        # didn't happen, instead of publishing a release whose plg points at
+        # MD5s that don't match the .txz files actually attached below.
+        run: |
+          set -eu
+          for f in dist/*.txz.md5; do
+            expected_md5=$(awk '{print $1}' "$f")
+            txz_name=$(basename "${f%.md5}")
+            if ! grep -qF "$expected_md5" plugin/podman.plg; then
+              echo "!! $txz_name's checksum ($expected_md5) is not referenced in plugin/podman.plg." >&2
+              echo "!! Did you forget to run scripts/release.sh and commit its changes before tagging?" >&2
+              exit 1
+            fi
+          done
+          echo "All package checksums are referenced in plugin/podman.plg — OK."
+
+      - name: Extract version from tag
+        id: version
+        run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Extract changelog section for this version
+        id: changelog
+        run: |
+          awk -v ver="${{ steps.version.outputs.value }}" '
+            $0 ~ "^## \\[" ver "\\]" { found=1; print; next }
+            found && /^## \[/ { exit }
+            found { print }
+          ' CHANGELOG.md > /tmp/release-notes.md
+          echo "path=/tmp/release-notes.md" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: "unraid-podman v${{ steps.version.outputs.value }}"
+          body_path: ${{ steps.changelog.outputs.path }}
+          # v0.x tags are treated as pre-releases until the plugin reaches a
+          # first stable 1.0.0 — see docs/ROADMAP.md.
+          prerelease: ${{ startsWith(steps.version.outputs.value, '0.') }}
+          files: |
+            dist/*.txz
+            dist/*.sha256
+            dist/*.md5
+            dist/CHECKSUMS.sha256
+            dist/CHECKSUMS.md5
+            plugin/podman.plg