[AZ-640] Bootstrap Rust workspace, CI/Docker, observability scaffold

Lands the first task of the implementation epic AZ-626: a cargo workspace
with 14 crates (shared + autopilot binary + 12 component crates), a
multi-stage Dockerfile + dev/test compose stacks, a Woodpecker CI pipeline,
the on-airframe systemd unit with flight-gate wiring, three environment
TOML configs, and the canonical entity catalogue from data_model.md as
`shared::models`.

Per-AC verification (full detail in
_docs/03_implementation/batch_01_cycle1_report.md):

- AC-1 cargo check --workspace clean
- AC-2 cargo test --workspace passes; per-crate it_compiles() <0.01 s
- AC-6 cargo build/test --no-default-features clean; VlmClient default
       impl returns VlmAssessment::disabled()
- AC-9 tracing-subscriber emits JSON logs with ts/level/target/fields
- AC-10 runtime::ensure_state_directories creates mapobjects/, audit/,
        pending_pushes/ under storage.state_dir

Deferred to external infra (artifacts written, verification re-runs in CI
and in downstream tasks):
- AC-3 Woodpecker runner; CI yml in place
- AC-4 docker-compose mocks land with AZ-660/AZ-644/AZ-675
- AC-5 SITL conformance lands with AZ-641/AZ-648/AZ-652
- AC-7 aarch64 cross-compile via cargo-zigbuild stage
- AC-8 systemd unit (Linux + systemd host)

Layering invariants from module-layout.md hold: shared (L1) imports
nothing; Layer 2 actor crates import only shared; Layer 3 coordinators
(operator_bridge, mission_executor) import only their documented Layer 2
deps; Layer 4 (scan_controller) imports its documented Layer 2 + Layer 3
deps; the autopilot binary (L5) is the only consumer of every component.

cargo fmt --all --check + cargo clippy --all-targets -- -D warnings both
clean. Jira AZ-640 transitioned to In Progress at the start of this batch;
the matching In Testing transition follows this commit.

Co-authored-by: Cursor <cursoragent@cursor.com>

crates/operator_bridge/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "operator_bridge"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+authors.workspace = true
+
+[dependencies]
+shared = { workspace = true }
+mapobjects_store = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
+async-trait = { workspace = true }
+serde = { workspace = true }

crates/operator_bridge/src/lib.rs

@@ -0,0 +1,117 @@
+//! `operator_bridge` — POI surfacing + operator command authentication.
+//!
+//! Real implementation lands in:
+//! - AZ-678 `operator_bridge_command_auth`
+//! - AZ-679 `operator_bridge_poi_surface`
+//! - AZ-680 `operator_bridge_command_dispatch`
+//! - AZ-681 `operator_bridge_safety_and_bit_ack`
+
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use tokio::sync::mpsc;
+
+use shared::contracts::OperatorCommandSink;
+use shared::error::{AutopilotError, Result};
+use shared::health::ComponentHealth;
+use shared::models::mission::Coordinate;
+use shared::models::operator::OperatorCommand;
+use shared::models::poi::Poi;
+
+const NAME: &str = "operator_bridge";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum OperatorDecision {
+    Confirmed,
+    Declined,
+    TimedOut,
+    StartTargetFollow,
+    ReleaseTargetFollow,
+}
+
+#[derive(Debug, Clone)]
+pub struct MiddleWaypointHint {
+    pub mission_id: String,
+    pub at: Coordinate,
+}
+
+#[derive(Debug, Clone)]
+pub enum TargetFollowEvent {
+    Start { target_id: String },
+    Release,
+}
+
+pub struct OperatorBridge {
+    middle_waypoint_tx: mpsc::Sender<MiddleWaypointHint>,
+    target_follow_tx: mpsc::Sender<TargetFollowEvent>,
+    middle_waypoint_rx: Option<mpsc::Receiver<MiddleWaypointHint>>,
+    target_follow_rx: Option<mpsc::Receiver<TargetFollowEvent>>,
+}
+
+impl OperatorBridge {
+    pub fn new(channel_capacity: usize) -> Self {
+        let (mw_tx, mw_rx) = mpsc::channel(channel_capacity);
+        let (tf_tx, tf_rx) = mpsc::channel(channel_capacity);
+        Self {
+            middle_waypoint_tx: mw_tx,
+            target_follow_tx: tf_tx,
+            middle_waypoint_rx: Some(mw_rx),
+            target_follow_rx: Some(tf_rx),
+        }
+    }
+
+    pub fn handle(&self) -> OperatorBridgeHandle {
+        OperatorBridgeHandle {
+            middle_waypoint_tx: self.middle_waypoint_tx.clone(),
+            target_follow_tx: self.target_follow_tx.clone(),
+        }
+    }
+
+    pub fn take_middle_waypoint_receiver(&mut self) -> Option<mpsc::Receiver<MiddleWaypointHint>> {
+        self.middle_waypoint_rx.take()
+    }
+
+    pub fn take_target_follow_receiver(&mut self) -> Option<mpsc::Receiver<TargetFollowEvent>> {
+        self.target_follow_rx.take()
+    }
+}
+
+#[derive(Clone)]
+pub struct OperatorBridgeHandle {
+    #[allow(dead_code)]
+    middle_waypoint_tx: mpsc::Sender<MiddleWaypointHint>,
+    #[allow(dead_code)]
+    target_follow_tx: mpsc::Sender<TargetFollowEvent>,
+}
+
+impl OperatorBridgeHandle {
+    pub async fn surface_poi(&self, _poi: Poi) -> Result<OperatorDecision> {
+        Err(AutopilotError::NotImplemented(
+            "operator_bridge::surface_poi (AZ-679)",
+        ))
+    }
+
+    pub fn health(&self) -> ComponentHealth {
+        ComponentHealth::disabled(NAME)
+    }
+}
+
+#[async_trait]
+impl OperatorCommandSink for OperatorBridgeHandle {
+    async fn dispatch(&self, _command: OperatorCommand) -> Result<()> {
+        Err(AutopilotError::NotImplemented(
+            "operator_bridge::dispatch (AZ-680)",
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn it_compiles() {
+        let h = OperatorBridge::new(8).handle();
+        assert_eq!(h.health().level, shared::health::HealthLevel::Disabled);
+    }
+}