Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/build-packages.sh

@@ -0,0 +1,103 @@
+#!/bin/bash
+# =============================================================================
+# scripts/build-packages.sh
+#
+# Orchestrates building all seven Slackware .txz packages this plugin ships
+# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs), by
+# running each package's <name>.SlackBuild in turn. See
+# docs/ARCHITECTURE.md section 5.2 (Build-Strategie).
+#
+# This script itself does not containerize anything — it assumes it is
+# already running inside a Slackware-compatible build environment (see
+# .github/workflows/build-packages.yml, which runs it inside a pinned
+# Slackware Docker image). Running it on a non-Slackware host will likely
+# still compile successfully for most components but the resulting .txz
+# should not be trusted for an actual Unraid install — see the container
+# image note in the CI workflow.
+#
+# Usage:
+#   scripts/build-packages.sh                 # build all packages
+#   scripts/build-packages.sh podman conmon    # build only the named ones
+#
+# Output: $REPO_ROOT/dist/<name>-<version>-<arch>-<build><tag>.txz
+#         plus a .sha256 and .md5 sidecar file per package (see
+#         scripts/lib/slackbuild-common.sh, sb_make_package).
+# Nothing under dist/ is committed to git — see .gitignore.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PACKAGES_DIR="$REPO_ROOT/packages"
+DIST_DIR="$REPO_ROOT/dist"
+
+# The full, ordered set of packages this project builds automatically.
+# containers-common is intentionally excluded for now — see packages/README.md.
+# unraid-podman (the plugin's own scaffolding, not an upstream component —
+# see packages/unraid-podman/README.md) is built last since it's by far the
+# fastest and has nothing useful to report on failure that earlier package
+# failures wouldn't already explain.
+ALL_PACKAGES=(conmon crun netavark aardvark-dns passt fuse-overlayfs podman unraid-podman)
+
+# Podman is listed second-to-last on purpose: among the seven upstream
+# components it is the slowest build and the one most likely to fail on a
+# dependency/tag mistake, so faster packages surface problems first during
+# local iteration. unraid-podman is genuinely last since it packages this
+# repo's own files and has no compile step at all.
+
+requested=("$@")
+if [ "${#requested[@]}" -eq 0 ]; then
+  targets=("${ALL_PACKAGES[@]}")
+else
+  targets=("${requested[@]}")
+fi
+
+mkdir -p "$DIST_DIR"
+
+echo "==> Building packages: ${targets[*]}"
+echo "==> Output directory:  $DIST_DIR"
+echo
+
+failed=()
+built=()
+
+for name in "${targets[@]}"; do
+  slackbuild="$PACKAGES_DIR/$name/$name.SlackBuild"
+
+  if [ ! -x "$slackbuild" ]; then
+    echo "!! No SlackBuild found/executable for '$name' ($slackbuild)" >&2
+    failed+=("$name")
+    continue
+  fi
+
+  echo "############################################################"
+  echo "## Building: $name"
+  echo "############################################################"
+
+  # Run each SlackBuild with OUTPUT pointed at the shared dist/ directory,
+  # so every package's .txz ends up in one place regardless of the
+  # per-package TMP/PKG scratch dirs it uses internally.
+  if OUTPUT="$DIST_DIR" "$slackbuild"; then
+    built+=("$name")
+  else
+    echo "!! Build failed: $name" >&2
+    failed+=("$name")
+  fi
+  echo
+done
+
+echo "============================================================"
+echo "Build summary"
+echo "============================================================"
+echo "Succeeded (${#built[@]}): ${built[*]:-none}"
+echo "Failed    (${#failed[@]}): ${failed[*]:-none}"
+
+if [ "${#failed[@]}" -gt 0 ]; then
+  echo
+  echo "!! One or more packages failed to build — see log above." >&2
+  exit 1
+fi
+
+echo
+echo "All packages built successfully. Artifacts in $DIST_DIR:"
+ls -1 "$DIST_DIR"