[AZ-640] Bootstrap Rust workspace, CI/Docker, observability scaffold

Lands the first task of the implementation epic AZ-626: a cargo workspace
with 14 crates (shared + autopilot binary + 12 component crates), a
multi-stage Dockerfile + dev/test compose stacks, a Woodpecker CI pipeline,
the on-airframe systemd unit with flight-gate wiring, three environment
TOML configs, and the canonical entity catalogue from data_model.md as
`shared::models`.

Per-AC verification (full detail in
_docs/03_implementation/batch_01_cycle1_report.md):

- AC-1 cargo check --workspace clean
- AC-2 cargo test --workspace passes; per-crate it_compiles() <0.01 s
- AC-6 cargo build/test --no-default-features clean; VlmClient default
       impl returns VlmAssessment::disabled()
- AC-9 tracing-subscriber emits JSON logs with ts/level/target/fields
- AC-10 runtime::ensure_state_directories creates mapobjects/, audit/,
        pending_pushes/ under storage.state_dir

Deferred to external infra (artifacts written, verification re-runs in CI
and in downstream tasks):
- AC-3 Woodpecker runner; CI yml in place
- AC-4 docker-compose mocks land with AZ-660/AZ-644/AZ-675
- AC-5 SITL conformance lands with AZ-641/AZ-648/AZ-652
- AC-7 aarch64 cross-compile via cargo-zigbuild stage
- AC-8 systemd unit (Linux + systemd host)

Layering invariants from module-layout.md hold: shared (L1) imports
nothing; Layer 2 actor crates import only shared; Layer 3 coordinators
(operator_bridge, mission_executor) import only their documented Layer 2
deps; Layer 4 (scan_controller) imports its documented Layer 2 + Layer 3
deps; the autopilot binary (L5) is the only consumer of every component.

cargo fmt --all --check + cargo clippy --all-targets -- -D warnings both
clean. Jira AZ-640 transitioned to In Progress at the start of this batch;
the matching In Testing transition follows this commit.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -1,3 +1,77 @@
-# Azaion.Autopilot
+# autopilot
 
-Python service for autonomous UAV control via MAVLink with behaviour tree execution.
+Onboard mission executor for the AZAION reconnaissance UAV. Single Rust binary; runs on
+NVIDIA Jetson Orin Nano Super (aarch64). See `_docs/02_document/architecture.md` for the
+authoritative system design.
+
+## Layout
+
+```text
+crates/
+  shared/                # canonical DTOs, config, error, health, observability, clock, contracts
+  autopilot/             # binary crate — runtime composition root + /health endpoint
+  mavlink_layer/         # hand-rolled MAVLink v2 transport
+  mission_client/        # missions API REST client + MapObjects sync
+  frame_ingest/          # RTSP pull + decode
+  detection_client/      # bi-directional gRPC to ../detections
+  movement_detector/     # ego-motion-compensated residual-motion clustering
+  semantic_analyzer/     # Tier 2 — primitive graph + ROI CNN
+  vlm_client/            # Tier 3 — optional NanoLLM/VILA local IPC
+  mapobjects_store/      # H3-indexed on-device map + ignored items
+  gimbal_controller/     # ViewPro A40 UDP control
+  scan_controller/       # central typed state machine (ZoomedOut/ZoomedIn/TargetFollow)
+  operator_bridge/       # POI surface + operator command authentication
+  mission_executor/      # multirotor + fixed-wing FSMs + geofence + failsafe
+  telemetry_stream/      # always-on uplink to Ground Station
+
+config/                  # TOML config per environment (dev / staging / prod)
+deploy/systemd/          # on-airframe native systemd unit (Option A)
+fixtures/                # replay clips (RTSP, MAVLink, missions, detections)
+tests/e2e/               # workspace-level blackbox scenarios
+benches/                 # NFR benchmark-gate harness
+```
+
+## Build
+
+```bash
+# Host-arch build + tests
+cargo build --workspace
+cargo test  --workspace --locked
+
+# Optional VLM feature path
+cargo build --workspace --features vlm
+
+# No-default-features path (enforces the VLM optionality contract)
+cargo build --workspace --no-default-features
+cargo test  --workspace --no-default-features
+
+# aarch64 cross-build (CI uses cargo-zigbuild; locally `cross` also works)
+cargo install --locked cargo-zigbuild
+rustup target add aarch64-unknown-linux-gnu
+cargo zigbuild --release --target aarch64-unknown-linux-gnu --workspace
+```
+
+## Run (dev)
+
+```bash
+cp .env.example .env
+docker compose up -d
+# Then inspect:
+curl -s http://127.0.0.1:8080/health | jq
+```
+
+## Documentation
+
+The full document tree lives under `_docs/`. Start with:
+
+- `_docs/00_problem/problem.md` — the problem statement
+- `_docs/02_document/architecture.md` — system architecture
+- `_docs/02_document/system-flows.md` — sequence diagrams
+- `_docs/02_document/components/<name>/description.md` — per-component specs
+- `_docs/02_document/deployment/{containerization,ci_cd_pipeline,observability}.md`
+
+## CI
+
+`.woodpecker.yml` drives the pipeline. Stages: `fetch → lint → unit-test →
+build-arm64 → build-no-vlm → integration-test → sitl-conformance → security-scan
+→ package → sign → publish → benchmark-gate (opt-in)`.