Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/checksums.sh

@@ -0,0 +1,70 @@
+#!/bin/bash
+# =============================================================================
+# scripts/checksums.sh
+#
+# Verifies and consolidates checksums for everything in dist/. Each package
+# already gets its own <file>.sha256 / <file>.md5 sidecar file from
+# sb_make_package (scripts/lib/slackbuild-common.sh) at build time — this
+# script:
+#   1. Re-verifies every .txz against its own sidecar checksum (defense in
+#      depth: catches disk corruption or a tampered artifact between the
+#      build job and the release job in CI).
+#   2. Writes a single consolidated CHECKSUMS.sha256 manifest covering all
+#      built packages, suitable for attaching to a GitHub Release so users
+#      can verify the whole set with one `sha256sum -c CHECKSUMS.sha256`.
+#
+# Usage:
+#   scripts/checksums.sh [dist-dir]      # defaults to <repo>/dist
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DIST_DIR="${1:-$REPO_ROOT/dist}"
+
+if [ ! -d "$DIST_DIR" ]; then
+  echo "!! No such directory: $DIST_DIR (nothing built yet?)" >&2
+  exit 1
+fi
+
+shopt -s nullglob
+txz_files=("$DIST_DIR"/*.txz)
+shopt -u nullglob
+
+if [ "${#txz_files[@]}" -eq 0 ]; then
+  echo "!! No .txz files found in $DIST_DIR" >&2
+  exit 1
+fi
+
+echo "==> Verifying per-package checksums"
+verify_failed=0
+for f in "${txz_files[@]}"; do
+  base=$(basename "$f")
+  sidecar="$f.sha256"
+  if [ ! -f "$sidecar" ]; then
+    echo "!! Missing $sidecar for $base" >&2
+    verify_failed=1
+    continue
+  fi
+  if ( cd "$DIST_DIR" && sha256sum -c "$(basename "$sidecar")" > /dev/null 2>&1 ); then
+    echo "OK   $base"
+  else
+    echo "FAIL $base" >&2
+    verify_failed=1
+  fi
+done
+
+if [ "$verify_failed" -ne 0 ]; then
+  echo "!! Checksum verification failed for one or more packages." >&2
+  exit 1
+fi
+
+echo
+echo "==> Writing consolidated manifest: $DIST_DIR/CHECKSUMS.sha256"
+( cd "$DIST_DIR" && sha256sum ./*.txz > CHECKSUMS.sha256 )
+
+echo "==> Writing consolidated MD5 manifest: $DIST_DIR/CHECKSUMS.md5"
+( cd "$DIST_DIR" && md5sum ./*.txz > CHECKSUMS.md5 )
+
+echo "==> Done."
+cat "$DIST_DIR/CHECKSUMS.sha256"