Add reproducible build system, native Unraid plugin, and WebUI

- versions.env pins podman, conmon, crun, netavark, aardvark-dns, passt,
  and fuse-overlayfs to verified upstream source checksums; SlackBuild
  recipes, scripts/build-packages.sh, checksums.sh, release.sh, and
  update-versions.sh implement the reproducible pipeline; GitHub Actions
  workflows build in a Slackware container and publish releases without
  committing any binaries.

- plugin/podman.plg installs/updates/removes all eight packages (the
  seven components plus the plugin's own unraid-podman scaffolding
  package) via upgradepkg, using the official Unraid array-event hook
  mechanism (event/disks_mounted, event/stopping) instead of editing
  /boot/config/go. rc.podman and the sbin/ helper scripts implement
  storage creation, config seeding/sync, preflight checks, autostart
  with per-container Safe-Mode, and package verify/update/rollback.

- webui/plugins/podman implements the Dashboard, Containers, Pods,
  Images, Volumes, Networks, Logs, Terminal, Compose, and Settings
  panels against the approved mockup (webui/mockups/prototype.html),
  talking to podman system service exclusively via PodmanClient.php
  (libpod REST API over the Unix socket), with two documented
  exceptions: Terminal's one-shot exec model and Compose's use of the
  podman compose CLI, since libpod has no REST equivalent for either.

- docs/ARCHITECTURE.md and docs/ROADMAP.md record the design decisions
  and honest current status (syntax-checked, unit- and
  integration-tested against fake sockets/servers; not yet run against
  a real Unraid/Podman/Slackware system).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/include/bootstrap.php

@@ -0,0 +1,37 @@
+<?php
+/**
+ * bootstrap.php
+ *
+ * Required by every file under webui/plugins/podman/ajax/ as its very
+ * first line. Centralizes the three things every endpoint would otherwise
+ * repeat: loading the other include/ modules, turning any PodmanApiException
+ * into the same JSON error envelope helpers.php's podman_json_error()
+ * produces (so the frontend never has to special-case "the socket was
+ * unreachable" vs. "podman returned a 404" vs. "something else threw"),
+ * and constructing a ready-to-use PodmanClient from the on-disk config.
+ *
+ * Usage, at the top of an ajax/*.php file:
+ *   require __DIR__ . '/../include/bootstrap.php';
+ *   // $client (PodmanClient) and $podmanConfig (PodmanConfig) are now set.
+ */
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/PodmanClient.php';
+require_once __DIR__ . '/Config.php';
+require_once __DIR__ . '/helpers.php';
+
+set_exception_handler(static function (\Throwable $e): void {
+    if ($e instanceof PodmanApiException) {
+        // A 0 status means "couldn't even reach the socket" (transport
+        // failure) rather than an HTTP error podman itself returned —
+        // surfaced as 503 (Service Unavailable) since that's the more
+        // accurate signal to the frontend than a generic 500.
+        $status = $e->httpStatus > 0 ? $e->httpStatus : 503;
+        podman_json_error($e->getMessage(), $status);
+    }
+    podman_json_error('Internal error: ' . $e->getMessage(), 500);
+});
+
+$podmanConfig = PodmanConfig::load();
+$client = $podmanConfig->newClient();