[AZ-263] Bootstrap: repo skeleton + Docker + CI + Alembic + Tier-1 tests

Implements the AZ-263 / E-BOOT initial structure task:

- Python src/-layout package `gps_denied_onboard/` with per-component
  interface stubs (14 components), type-only DTOs under `_types/`,
  shared helpers under `helpers/` (R14 LightGlue ownership), structured
  JSON logging, runtime composition root with env-var fail-fast gate,
  healthcheck module shared by Docker and CI smoke.
- CMake top-level + `cmake/{build_options,dependencies,strategies}.cmake`
  with the BUILD_* per-binary flags (ADR-002) and pinned external git
  refs for OKVIS2 / VINS-Mono / GTSAM / FAISS / OpenCV >=4.12.0.
- Three Dockerfiles (companion-tier1, operator-tooling,
  mock-suite-sat-service) + two compose files (dev + Tier-1 test).
- Four GitHub Actions workflows: ci.yml (lint/unit/integration/dual
  binary build/SBOM diff/security), ci-tier2.yml (self-hosted Jetson
  AC-bound NFTs), release.yml, cve-rescan.yml.
- Two CI gate scripts: `ci/sbom_diff.py` (deployment SBOM subset +
  R02 exclusion), `ci/opencv_pin_gate.py` (>=4.12.0 enforcement,
  D-CROSS-CVE-1).
- Alembic-driven Postgres 16 initial migration `0001_initial.py`
  mirroring satellite-provider tiles + flights + sector_classifications
  + manifests + engine_cache_entries (data_model.md s 2).
- Tier-1 test scaffolding: 95 passing unit tests covering every AC,
  per-component smoke tests, structured logging JSON output check,
  env-var gate check, healthcheck import check. Two CI-gated tests
  (cmake configure, actionlint) skip locally with explicit reasons.
- Batch report + code review report under `_docs/03_implementation/`.

Verdict: PASS_WITH_WARNINGS (two Low findings, both informational).
Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -0,0 +1,89 @@
+services:
+  companion:
+    build:
+      context: .
+      dockerfile: docker/companion-tier1.Dockerfile
+    image: gps-denied-onboard/companion:dev
+    depends_on:
+      db:
+        condition: service_healthy
+      mock-sat:
+        condition: service_healthy
+    environment:
+      GPS_DENIED_FC_PROFILE: ardupilot_plane
+      GPS_DENIED_TIER: "1"
+      DB_URL: postgresql://gps_denied:dev@db:5432/gps_denied
+      SATELLITE_PROVIDER_URL: http://mock-sat:5100
+      CAMERA_CALIBRATION_PATH: /fixtures/calibration/adti26.json
+      LOG_LEVEL: DEBUG
+      LOG_SINK: console
+      INFERENCE_BACKEND: pytorch_fp16
+      FDR_PATH: /var/lib/gps-denied/fdr
+      TILE_CACHE_PATH: /var/lib/gps-denied/tiles
+      MAVLINK_SIGNING_KEY: /fixtures/mavlink_signing/dev_key
+    volumes:
+      - ./tests/fixtures:/fixtures:ro
+      - fdr-data:/var/lib/gps-denied/fdr
+      - tile-data:/var/lib/gps-denied/tiles
+    healthcheck:
+      test: ["CMD", "python3", "-m", "gps_denied_onboard.healthcheck"]
+      interval: 10s
+      timeout: 3s
+      retries: 3
+
+  operator-tooling:
+    build:
+      context: .
+      dockerfile: docker/operator-tooling.Dockerfile
+    image: gps-denied-onboard/operator-tooling:dev
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      GPS_DENIED_FC_PROFILE: ardupilot_plane
+      GPS_DENIED_TIER: "1"
+      DB_URL: postgresql://gps_denied:dev@db:5432/gps_denied
+      SATELLITE_PROVIDER_URL: http://mock-sat:5100
+      CAMERA_CALIBRATION_PATH: /fixtures/calibration/adti26.json
+      LOG_LEVEL: DEBUG
+      LOG_SINK: console
+      INFERENCE_BACKEND: pytorch_fp16
+      FDR_PATH: /var/lib/gps-denied/fdr
+      TILE_CACHE_PATH: /var/lib/gps-denied/tiles
+      MAVLINK_SIGNING_KEY: /fixtures/mavlink_signing/dev_key
+    volumes:
+      - ./tests/fixtures:/fixtures:ro
+      - tile-data:/var/lib/gps-denied/tiles
+
+  mock-sat:
+    build:
+      context: .
+      dockerfile: docker/mock-suite-sat-service.Dockerfile
+    image: gps-denied-onboard/mock-suite-sat-service:dev
+    ports:
+      - "5100:5100"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5100/healthz').read()"]
+      interval: 5s
+      timeout: 2s
+      retries: 5
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: gps_denied
+      POSTGRES_PASSWORD: dev
+      POSTGRES_DB: gps_denied
+    volumes:
+      - db-data:/var/lib/postgresql/data
+      - ./docker/db-init:/docker-entrypoint-initdb.d:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U gps_denied -d gps_denied"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+volumes:
+  db-data: {}
+  fdr-data: {}
+  tile-data: {}