[AZ-263] Bootstrap: repo skeleton + Docker + CI + Alembic + Tier-1 tests

Implements the AZ-263 / E-BOOT initial structure task:

- Python src/-layout package `gps_denied_onboard/` with per-component
  interface stubs (14 components), type-only DTOs under `_types/`,
  shared helpers under `helpers/` (R14 LightGlue ownership), structured
  JSON logging, runtime composition root with env-var fail-fast gate,
  healthcheck module shared by Docker and CI smoke.
- CMake top-level + `cmake/{build_options,dependencies,strategies}.cmake`
  with the BUILD_* per-binary flags (ADR-002) and pinned external git
  refs for OKVIS2 / VINS-Mono / GTSAM / FAISS / OpenCV >=4.12.0.
- Three Dockerfiles (companion-tier1, operator-tooling,
  mock-suite-sat-service) + two compose files (dev + Tier-1 test).
- Four GitHub Actions workflows: ci.yml (lint/unit/integration/dual
  binary build/SBOM diff/security), ci-tier2.yml (self-hosted Jetson
  AC-bound NFTs), release.yml, cve-rescan.yml.
- Two CI gate scripts: `ci/sbom_diff.py` (deployment SBOM subset +
  R02 exclusion), `ci/opencv_pin_gate.py` (>=4.12.0 enforcement,
  D-CROSS-CVE-1).
- Alembic-driven Postgres 16 initial migration `0001_initial.py`
  mirroring satellite-provider tiles + flights + sector_classifications
  + manifests + engine_cache_entries (data_model.md s 2).
- Tier-1 test scaffolding: 95 passing unit tests covering every AC,
  per-component smoke tests, structured logging JSON output check,
  env-var gate check, healthcheck import check. Two CI-gated tests
  (cmake configure, actionlint) skip locally with explicit reasons.
- Batch report + code review report under `_docs/03_implementation/`.

Verdict: PASS_WITH_WARNINGS (two Low findings, both informational).
Co-authored-by: Cursor <cursoragent@cursor.com>

cmake/build_options.cmake

@@ -0,0 +1,36 @@
+# Per-binary build-time exclusion (ADR-002).
+#
+# Single source of truth for the BUILD_* flag set referenced from
+# `.github/workflows/ci.yml` and the composition-root validator in
+# `src/gps_denied_onboard/runtime_root.py`.
+
+option(BUILD_OKVIS2                 "Build C1 OKVIS2 VIO strategy"              ON)
+option(BUILD_VINS_MONO              "Build C1 VINS-Mono VIO strategy"          OFF)
+option(BUILD_KLT_RANSAC             "Build C1 KLT/RANSAC simple baseline"      ON)
+
+option(BUILD_VPR_ULTRA              "Build C2 UltraVPR (primary)"               ON)
+option(BUILD_VPR_MEGALOC            "Build C2 MegaLoc"                         OFF)
+option(BUILD_VPR_MIXVPR             "Build C2 MixVPR"                          OFF)
+option(BUILD_VPR_SELAVPR            "Build C2 SelaVPR"                         OFF)
+option(BUILD_VPR_EIGENPLACES        "Build C2 EigenPlaces"                     OFF)
+option(BUILD_VPR_NETVLAD            "Build C2 NetVLAD baseline"                 ON)
+option(BUILD_VPR_SALAD              "Build C2 SALAD"                           OFF)
+
+option(BUILD_TENSORRT_RUNTIME       "Build C7 TensorRT inference runtime"       ON)
+option(BUILD_PYTORCH_RUNTIME        "Build C7 PyTorch FP16 inference runtime"  OFF)
+
+option(BUILD_C10_PROVISIONING       "Build C10 (operator-only)"                OFF)
+option(BUILD_C11_TILE_MANAGER       "Build C11 (operator-only)"                OFF)
+option(BUILD_C12_OPERATOR_TOOLING   "Build C12 (operator-only)"                OFF)
+
+option(BUILD_GTSAM_BINDINGS         "Build cpp/gtsam_bindings (C4+C5)"          ON)
+option(BUILD_FAISS_INDEX            "Build cpp/faiss_index (C6)"                ON)
+
+option(BUILD_VIDEO_FILE_FRAME_SOURCE "Build replay video frame source (AZ-265)" OFF)
+option(BUILD_TLOG_REPLAY_ADAPTER     "Build replay tlog FC adapter (AZ-265)"   OFF)
+option(BUILD_REPLAY_SINK_JSONL       "Build replay JSONL sink (AZ-265)"        OFF)
+option(BUILD_REPLAY_CLI              "Build replay CLI entrypoint (AZ-265)"    OFF)
+option(BUILD_LIVE_CAMERA_FRAME_SOURCE "Build live camera frame source"          ON)
+
+message(STATUS "BUILD_OKVIS2=${BUILD_OKVIS2} BUILD_VINS_MONO=${BUILD_VINS_MONO}")
+message(STATUS "BUILD_TENSORRT_RUNTIME=${BUILD_TENSORRT_RUNTIME} BUILD_GTSAM_BINDINGS=${BUILD_GTSAM_BINDINGS}")

cmake/dependencies.cmake

@@ -0,0 +1,24 @@
+# Pinned third-party native dependencies.
+#
+# D-CROSS-CVE-1: OpenCV must be >= 4.12.0. The `ci/opencv_pin_gate.py` CI step
+# also enforces this against the resolved pyproject lockfile.
+
+# pybind11 (header-only — vendored under cpp/pybind11/ as a submodule placeholder).
+set(PYBIND11_VENDORED_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cpp/pybind11")
+
+# OpenCV minimum (D-CROSS-CVE-1).
+set(OPENCV_MIN_VERSION "4.12.0")
+
+# Pinned native dependency commit refs — bootstrap declares the pins; concrete
+# fetch_content / find_package wiring lands with the dependent component tasks.
+set(OKVIS2_GIT_TAG     "v2.0.0"  CACHE STRING "OKVIS2 git tag/commit")
+set(VINS_MONO_GIT_TAG  "v0.9"    CACHE STRING "VINS-Mono git tag/commit")
+set(GTSAM_GIT_TAG      "4.2.0"   CACHE STRING "GTSAM git tag/commit")
+set(FAISS_GIT_TAG      "v1.8.0"  CACHE STRING "FAISS git tag/commit")
+
+# Output pin summary for CI capture into the SBOM.
+message(STATUS "[deps] OPENCV_MIN_VERSION=${OPENCV_MIN_VERSION}")
+message(STATUS "[deps] OKVIS2_GIT_TAG=${OKVIS2_GIT_TAG}")
+message(STATUS "[deps] VINS_MONO_GIT_TAG=${VINS_MONO_GIT_TAG}")
+message(STATUS "[deps] GTSAM_GIT_TAG=${GTSAM_GIT_TAG}")
+message(STATUS "[deps] FAISS_GIT_TAG=${FAISS_GIT_TAG}")

cmake/strategies.cmake

@@ -0,0 +1,29 @@
+# Helper: register a strategy implementation behind its BUILD_* flag.
+#
+# Usage:
+#   gps_denied_register_strategy(
+#     NAME my_strategy
+#     FLAG BUILD_MY_STRATEGY
+#     SOURCES src1.cpp src2.cpp
+#   )
+#
+# When the FLAG is OFF, the strategy target is NOT created at all. The
+# composition-root validator (Python side) refuses to wire a strategy whose
+# flag is OFF — see `src/gps_denied_onboard/runtime_root.py`.
+
+function(gps_denied_register_strategy)
+  cmake_parse_arguments(_ARG "" "NAME;FLAG" "SOURCES;LINK_LIBRARIES" ${ARGN})
+  if(NOT _ARG_NAME OR NOT _ARG_FLAG)
+    message(FATAL_ERROR "gps_denied_register_strategy: NAME and FLAG are required.")
+  endif()
+  if(NOT ${${_ARG_FLAG}})
+    message(STATUS "[strategy] Skipping ${_ARG_NAME} (${_ARG_FLAG}=OFF)")
+    return()
+  endif()
+  add_library(${_ARG_NAME} STATIC ${_ARG_SOURCES})
+  target_include_directories(${_ARG_NAME} PUBLIC ${CMAKE_CURRENT_SOURCE_DIR})
+  if(_ARG_LINK_LIBRARIES)
+    target_link_libraries(${_ARG_NAME} PUBLIC ${_ARG_LINK_LIBRARIES})
+  endif()
+  message(STATUS "[strategy] Registered ${_ARG_NAME} (${_ARG_FLAG}=ON)")
+endfunction()