[AZ-263] Bootstrap: repo skeleton + Docker + CI + Alembic + Tier-1 tests

Implements the AZ-263 / E-BOOT initial structure task:

- Python src/-layout package `gps_denied_onboard/` with per-component
  interface stubs (14 components), type-only DTOs under `_types/`,
  shared helpers under `helpers/` (R14 LightGlue ownership), structured
  JSON logging, runtime composition root with env-var fail-fast gate,
  healthcheck module shared by Docker and CI smoke.
- CMake top-level + `cmake/{build_options,dependencies,strategies}.cmake`
  with the BUILD_* per-binary flags (ADR-002) and pinned external git
  refs for OKVIS2 / VINS-Mono / GTSAM / FAISS / OpenCV >=4.12.0.
- Three Dockerfiles (companion-tier1, operator-tooling,
  mock-suite-sat-service) + two compose files (dev + Tier-1 test).
- Four GitHub Actions workflows: ci.yml (lint/unit/integration/dual
  binary build/SBOM diff/security), ci-tier2.yml (self-hosted Jetson
  AC-bound NFTs), release.yml, cve-rescan.yml.
- Two CI gate scripts: `ci/sbom_diff.py` (deployment SBOM subset +
  R02 exclusion), `ci/opencv_pin_gate.py` (>=4.12.0 enforcement,
  D-CROSS-CVE-1).
- Alembic-driven Postgres 16 initial migration `0001_initial.py`
  mirroring satellite-provider tiles + flights + sector_classifications
  + manifests + engine_cache_entries (data_model.md s 2).
- Tier-1 test scaffolding: 95 passing unit tests covering every AC,
  per-component smoke tests, structured logging JSON output check,
  env-var gate check, healthcheck import check. Two CI-gated tests
  (cmake configure, actionlint) skip locally with explicit reasons.
- Batch report + code review report under `_docs/03_implementation/`.

Verdict: PASS_WITH_WARNINGS (two Low findings, both informational).
Co-authored-by: Cursor <cursoragent@cursor.com>

src/gps_denied_onboard/fdr_client/__init__.py

@@ -0,0 +1,10 @@
+"""FDR producer client (E-CC-FDR-CLIENT / AZ-247).
+
+Producer-side API used by every component. Consumer-side writer lives in
+`gps_denied_onboard.components.c13_fdr` (AZ-248 / E-C13).
+"""
+
+from gps_denied_onboard.fdr_client.client import FdrClient
+from gps_denied_onboard.fdr_client.records import FdrRecord
+
+__all__ = ["FdrClient", "FdrRecord"]

src/gps_denied_onboard/fdr_client/client.py

@@ -0,0 +1,16 @@
+"""FDR producer-side client API — STUB.
+
+Concrete client is owned by AZ-273. Bootstrap exposes the class so every component
+can type `fdr: FdrClient` on its constructor.
+"""
+
+from __future__ import annotations
+
+from gps_denied_onboard.fdr_client.records import FdrRecord
+
+
+class FdrClient:
+    """Producer-side FDR API: enqueue records, drop-oldest on overrun."""
+
+    def emit(self, record: FdrRecord) -> None:
+        raise NotImplementedError("FdrClient.emit concrete impl is AZ-273")

src/gps_denied_onboard/fdr_client/queue.py

@@ -0,0 +1,21 @@
+"""Lock-free SPSC ring buffer — STUB.
+
+Concrete drop-oldest-on-overrun ring buffer is owned by AZ-273.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+class SpscRingBuffer:
+    """Single-producer single-consumer lock-free ring buffer."""
+
+    def __init__(self, capacity: int) -> None:
+        self.capacity = capacity
+
+    def push(self, item: Any) -> bool:
+        raise NotImplementedError("FdrClient ring-buffer concrete impl is AZ-273")
+
+    def pop(self) -> Any | None:
+        raise NotImplementedError("FdrClient ring-buffer concrete impl is AZ-273")

src/gps_denied_onboard/fdr_client/records.py

@@ -0,0 +1,25 @@
+"""FDR record schema — STUB.
+
+Concrete schema (estimates / IMU / MAVLink / health / tile / thumbnail discriminated
+record types) is owned by AZ-272. Bootstrap declares the umbrella DTO so every
+producer can import it.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime
+from typing import Any
+
+
+@dataclass(frozen=True)
+class FdrRecord:
+    """A single FDR record (record-type discriminator + payload).
+
+    The full discriminated-union of record types is defined by AZ-272.
+    """
+
+    record_type: str
+    timestamp: datetime
+    producer: str
+    payload: dict[str, Any] = field(default_factory=dict)