[AZ-263] Bootstrap: repo skeleton + Docker + CI + Alembic + Tier-1 tests

Implements the AZ-263 / E-BOOT initial structure task:

- Python src/-layout package `gps_denied_onboard/` with per-component
  interface stubs (14 components), type-only DTOs under `_types/`,
  shared helpers under `helpers/` (R14 LightGlue ownership), structured
  JSON logging, runtime composition root with env-var fail-fast gate,
  healthcheck module shared by Docker and CI smoke.
- CMake top-level + `cmake/{build_options,dependencies,strategies}.cmake`
  with the BUILD_* per-binary flags (ADR-002) and pinned external git
  refs for OKVIS2 / VINS-Mono / GTSAM / FAISS / OpenCV >=4.12.0.
- Three Dockerfiles (companion-tier1, operator-tooling,
  mock-suite-sat-service) + two compose files (dev + Tier-1 test).
- Four GitHub Actions workflows: ci.yml (lint/unit/integration/dual
  binary build/SBOM diff/security), ci-tier2.yml (self-hosted Jetson
  AC-bound NFTs), release.yml, cve-rescan.yml.
- Two CI gate scripts: `ci/sbom_diff.py` (deployment SBOM subset +
  R02 exclusion), `ci/opencv_pin_gate.py` (>=4.12.0 enforcement,
  D-CROSS-CVE-1).
- Alembic-driven Postgres 16 initial migration `0001_initial.py`
  mirroring satellite-provider tiles + flights + sector_classifications
  + manifests + engine_cache_entries (data_model.md s 2).
- Tier-1 test scaffolding: 95 passing unit tests covering every AC,
  per-component smoke tests, structured logging JSON output check,
  env-var gate check, healthcheck import check. Two CI-gated tests
  (cmake configure, actionlint) skip locally with explicit reasons.
- Batch report + code review report under `_docs/03_implementation/`.

Verdict: PASS_WITH_WARNINGS (two Low findings, both informational).
Co-authored-by: Cursor <cursoragent@cursor.com>

src/gps_denied_onboard/helpers/__init__.py

@@ -0,0 +1,5 @@
+"""Shared utilities (owned by AZ-264 / E-CC-HELPERS).
+
+Bootstrap (AZ-263) creates these as importable stubs; concrete implementations are
+filled in by per-helper tasks under AZ-264. See `_docs/02_document/common-helpers/`.
+"""

src/gps_denied_onboard/helpers/descriptor_normaliser.py

@@ -0,0 +1,14 @@
+"""Descriptor-normalisation utility — STUB.
+
+Concrete impl owned by AZ-283. Contract:
+`_docs/02_document/common-helpers/08_helper_descriptor_normaliser.md`.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def l2_normalise(descriptors: Any) -> Any:
+    """L2-normalise a (N, D) descriptor matrix in-place semantics."""
+    raise NotImplementedError("descriptor_normaliser concrete impl is AZ-283")

src/gps_denied_onboard/helpers/engine_filename_schema.py

@@ -0,0 +1,28 @@
+"""TensorRT engine filename schema — STUB.
+
+D-C10-7 self-describing engine names. Concrete impl owned by AZ-281. Contract:
+`_docs/02_document/common-helpers/06_helper_engine_filename_schema.md`.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class EngineFilename:
+    """Parsed parts of a self-describing engine filename."""
+
+    model_name: str
+    sm_arch: str
+    jetpack_version: str
+    tensorrt_version: str
+    precision: str
+    content_hash: str
+
+    def render(self) -> str:
+        raise NotImplementedError("engine_filename_schema concrete impl is AZ-281")
+
+    @classmethod
+    def parse(cls, filename: str) -> EngineFilename:
+        raise NotImplementedError("engine_filename_schema concrete impl is AZ-281")

src/gps_denied_onboard/helpers/imu_preintegrator.py

@@ -0,0 +1,16 @@
+"""IMU preintegration helper — STUB.
+
+Concrete implementation is owned by AZ-276 (E-CC-HELPERS). Contract lives at
+`_docs/02_document/common-helpers/01_helper_imu_preintegrator.md`.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+class ImuPreintegrator:
+    """Preintegrate IMU samples over a time window for VIO / state-estimator factor adds."""
+
+    def preintegrate(self, samples: Any) -> Any:
+        raise NotImplementedError("ImuPreintegrator concrete impl is AZ-276 (E-CC-HELPERS)")

src/gps_denied_onboard/helpers/lightglue_runtime.py

@@ -0,0 +1,19 @@
+"""Shared LightGlue inference runtime — STUB.
+
+R14 fix: this helper is the single owner; both C2.5 (single-pair inlier counter)
+and C3 (matcher) import it. Neither component depends on the other.
+
+Concrete implementation is owned by AZ-278. Contract:
+`_docs/02_document/common-helpers/03_helper_lightglue_runtime.md`.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+class LightGlueRuntime:
+    """Shared LightGlue matcher runtime."""
+
+    def match(self, descriptors_a: Any, descriptors_b: Any) -> Any:
+        raise NotImplementedError("LightGlueRuntime concrete impl is AZ-278")

src/gps_denied_onboard/helpers/ransac_filter.py

@@ -0,0 +1,14 @@
+"""Generic RANSAC inlier filter — STUB.
+
+Concrete impl owned by AZ-282. Contract:
+`_docs/02_document/common-helpers/07_helper_ransac_filter.md`.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def filter_inliers(matches: Any, threshold_px: float, max_iters: int = 1000) -> Any:
+    """Run RANSAC on a set of point matches and return the inlier mask."""
+    raise NotImplementedError("ransac_filter concrete impl is AZ-282")

src/gps_denied_onboard/helpers/se3_utils.py

@@ -0,0 +1,29 @@
+"""SE(3) utility helpers — STUB.
+
+Concrete implementation is owned by AZ-277. Contract:
+`_docs/02_document/common-helpers/02_helper_se3_utils.md`.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def compose(a_se3: Any, b_se3: Any) -> Any:
+    """Compose two SE(3) transforms."""
+    raise NotImplementedError("se3_utils concrete impl is AZ-277")
+
+
+def inverse(t_se3: Any) -> Any:
+    """Invert an SE(3) transform."""
+    raise NotImplementedError("se3_utils concrete impl is AZ-277")
+
+
+def log_map(t_se3: Any) -> Any:
+    """SE(3) → se(3) log map (returns a 6-vector)."""
+    raise NotImplementedError("se3_utils concrete impl is AZ-277")
+
+
+def exp_map(xi_6: Any) -> Any:
+    """se(3) → SE(3) exp map (consumes a 6-vector)."""
+    raise NotImplementedError("se3_utils concrete impl is AZ-277")

src/gps_denied_onboard/helpers/sha256_sidecar.py

@@ -0,0 +1,19 @@
+"""Content-hash sidecar helper — STUB.
+
+D-C10-3 content-hash gate. Concrete impl owned by AZ-280. Contract:
+`_docs/02_document/common-helpers/05_helper_sha256_sidecar.md`.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def compute_sidecar(target_path: Path) -> Path:
+    """Compute SHA-256 of `target_path` and write a sidecar file next to it."""
+    raise NotImplementedError("sha256_sidecar concrete impl is AZ-280")
+
+
+def verify_sidecar(target_path: Path) -> bool:
+    """Verify that the sidecar matches the file content."""
+    raise NotImplementedError("sha256_sidecar concrete impl is AZ-280")

src/gps_denied_onboard/helpers/wgs_converter.py

@@ -0,0 +1,26 @@
+"""WGS84 ↔ local-tangent-plane converter — STUB.
+
+Concrete implementation is owned by AZ-279. Contract:
+`_docs/02_document/common-helpers/04_helper_wgs_converter.md`.
+"""
+
+from __future__ import annotations
+
+
+def wgs84_to_ltp(
+    lat_deg: float,
+    lon_deg: float,
+    alt_m: float,
+    ref_lat_deg: float,
+    ref_lon_deg: float,
+    ref_alt_m: float,
+) -> tuple[float, float, float]:
+    """Convert a WGS-84 lat/lon/alt to local-tangent-plane east/north/up metres."""
+    raise NotImplementedError("wgs_converter concrete impl is AZ-279")
+
+
+def ltp_to_wgs84(
+    e_m: float, n_m: float, u_m: float, ref_lat_deg: float, ref_lon_deg: float, ref_alt_m: float
+) -> tuple[float, float, float]:
+    """Inverse of wgs84_to_ltp."""
+    raise NotImplementedError("wgs_converter concrete impl is AZ-279")