Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/build-packages.yml

@@ -0,0 +1,92 @@
+name: Build Packages
+
+# Builds the seven Slackware .txz packages defined under packages/
+# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs)
+# inside a Slackware container, verifies + consolidates their checksums, and
+# uploads the result as a workflow artifact.
+#
+# Intentionally does NOT commit any built binary back to the repository —
+# packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts
+# only ever leave this workflow via the "Upload build artifacts" step below
+# (retained by GitHub Actions, not the repo) or, for tagged releases, via
+# release.yml attaching them to a GitHub Release.
+#
+# See docs/ARCHITECTURE.md section 5 (Paketmanagement).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "packages/**"
+      - "versions.env"
+      - "scripts/**"
+      - ".github/workflows/build-packages.yml"
+  pull_request:
+    paths:
+      - "packages/**"
+      - "versions.env"
+      - "scripts/**"
+      - ".github/workflows/build-packages.yml"
+  workflow_dispatch:
+    inputs:
+      packages:
+        description: >
+          Space-separated package names to build (default: all seven).
+          Example: "podman conmon"
+        required: false
+        default: ""
+  workflow_call:
+    outputs:
+      artifact-name:
+        description: "Name of the uploaded dist/ artifact"
+        value: ${{ jobs.build.outputs.artifact-name }}
+
+# Pin the Slackware build image by tag here. vbatts/slackware is a
+# long-standing, widely used Slackware Docker image; swap this (and ideally
+# pin by digest) if the project standardizes on a different/self-hosted
+# base image. See scripts/ci/setup-slackware-buildenv.sh for how missing
+# build dependencies are bootstrapped on top of whatever this image ships.
+env:
+  SLACKWARE_IMAGE: "vbatts/slackware:15.0"
+
+jobs:
+  build:
+    name: Build .txz packages
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.SLACKWARE_IMAGE }}
+    outputs:
+      artifact-name: ${{ steps.artifact-name.outputs.value }}
+    steps:
+      - name: Install git and tar (needed before actions/checkout can run)
+        run: |
+          (command -v git && command -v tar) || \
+            (echo "!! base image is missing git/tar — see SLACKWARE_IMAGE in this workflow" && exit 1)
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Slackware build environment
+        run: scripts/ci/setup-slackware-buildenv.sh
+
+      - name: Build packages
+        run: scripts/build-packages.sh ${{ github.event.inputs.packages }}
+
+      - name: Verify and consolidate checksums
+        run: scripts/checksums.sh
+
+      - name: Compute artifact name
+        id: artifact-name
+        run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.artifact-name.outputs.value }}
+          path: |
+            dist/*.txz
+            dist/*.sha256
+            dist/*.md5
+            dist/CHECKSUMS.sha256
+            dist/CHECKSUMS.md5
+          if-no-files-found: error
+          retention-days: 14