build: add Docker-only Makefile, SDK setup and product manifest

- Makefile: every target runs in a container as your UID/GID, with no
  capabilities, a read-only root filesystem, only the project folder
  mounted and no network except for image builds and `make sdk`.
  Serial even under `make -j`. `make nuke` removes containers, images,
  the dedicated buildx builder and .cache/ after confirmation.
- sdk-setup.sh: agreement acceptance pinned to the hash you read,
  password login (never stored), SDK 9.2.0 and device download, and
  the login token deleted afterwards.
- gen-key.sh: RSA-4096 developer key into .cache/keys, never
  overwritten, with backup instructions.
- manifest.xml: watch-app, minApiLevel 5.0.0, no permissions, and the
  72 watches with API 5.0+ and at least 512 KB for apps.
- .gitignore, lint configs and CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 49 insertions, 0 deletions

diff --git a/docker/scripts/ciq-env.sh b/docker/scripts/ciq-env.sh
new file mode 100755
index 0000000..945d59a
--- /dev/null
+++ b/docker/scripts/ciq-env.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Shared helpers for the container scripts. Source this file; don't run it.
+#
+# Paths, as seen inside the container:
+#   /work               the project folder (bind mount)
+#   /home/dev           the project's .cache/home folder (bind mount); the Garmin
+#                       tools keep the SDK and device files under ~/.Garmin
+#   /work/.cache/keys   the developer key (never baked into an image)
+
+CIQ_HOME="${HOME}/.Garmin/ConnectIQ"
+KEY_DIR="/work/.cache/keys"
+DEV_KEY="${KEY_DIR}/developer_key.der"
+BUILD_DIR="/work/build"
+
+# Print an error and stop. Used for every user-facing failure, so the message
+# says what to do next instead of leaving a bare stack trace.
+die() {
+  echo "error: $*" >&2
+  exit 1
+}
+
+# Progress line on stderr, so stdout stays clean for machine-readable output.
+log() {
+  echo "==> $*" >&2
+}
+
+# Find the SDK selected by `make sdk` and put its bin/ folder on PATH.
+# Sets CIQ_SDK to the SDK root folder.
+ciq_require_sdk() {
+  local cfg="${CIQ_HOME}/current-sdk.cfg"
+  [[ -f "${cfg}" ]] || die "Connect IQ SDK not installed. Run 'make sdk' first (you accept Garmin's licence and log in there)."
+  CIQ_SDK="$(tr -d '\r\n' < "${cfg}")"
+  CIQ_SDK="${CIQ_SDK%/}"
+  [[ -x "${CIQ_SDK}/bin/monkeyc" ]] || die "SDK folder '${CIQ_SDK}' has no bin/monkeyc. Run 'make sdk' again."
+  export CIQ_SDK
+  export PATH="${CIQ_SDK}/bin:${PATH}"
+}
+
+# The developer key signs every build, including test builds.
+ciq_require_key() {
+  [[ -f "${DEV_KEY}" ]] || die "No developer key at .cache/keys/developer_key.der. Run 'make key' first."
+}
+
+# Fail early, with a pointer to `make sdk`, when a device's files are missing.
+ciq_require_device() {
+  local device="$1"
+  [[ -f "${CIQ_HOME}/Devices/${device}/compiler.json" ]] \
+    || die "No device files for '${device}'. Is it in manifest.xml? Then run 'make sdk' to download them."
+}