build: add Docker-only Makefile, SDK setup and product manifest

- Makefile: every target runs in a container as your UID/GID, with no
  capabilities, a read-only root filesystem, only the project folder
  mounted and no network except for image builds and `make sdk`.
  Serial even under `make -j`. `make nuke` removes containers, images,
  the dedicated buildx builder and .cache/ after confirmation.
- sdk-setup.sh: agreement acceptance pinned to the hash you read,
  password login (never stored), SDK 9.2.0 and device download, and
  the login token deleted afterwards.
- gen-key.sh: RSA-4096 developer key into .cache/keys, never
  overwritten, with backup instructions.
- manifest.xml: watch-app, minApiLevel 5.0.0, no permissions, and the
  72 watches with API 5.0+ and at least 512 KB for apps.
- .gitignore, lint configs and CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 39 insertions, 0 deletions

diff --git a/docker/scripts/gen-key.sh b/docker/scripts/gen-key.sh
new file mode 100755
index 0000000..7b99863
--- /dev/null
+++ b/docker/scripts/gen-key.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Generate the developer key that signs every build (README section 15.6).
+#
+# Output: .cache/keys/developer_key.der (PKCS#8 DER, what monkeyc wants) and
+# developer_key.pem, both mode 600 and git-ignored. An existing key is never
+# overwritten: the Connect IQ Store rejects updates signed with a different
+# key, so replacing it by accident would strand the published app.
+set -euo pipefail
+# shellcheck source=ciq-env.sh
+source "$(dirname "${BASH_SOURCE[0]}")/ciq-env.sh"
+
+umask 077
+mkdir -p "${KEY_DIR}"
+
+if [[ -f "${DEV_KEY}" ]]; then
+  log "Developer key already exists at .cache/keys/developer_key.der; leaving it untouched."
+  exit 0
+fi
+
+log "Generating a 4096-bit RSA developer key (this takes a few seconds)..."
+openssl genrsa -out "${KEY_DIR}/developer_key.pem" 4096 2>/dev/null
+openssl pkcs8 -topk8 -inform PEM -outform DER -nocrypt \
+  -in "${KEY_DIR}/developer_key.pem" -out "${DEV_KEY}"
+chmod 600 "${KEY_DIR}/developer_key.pem" "${DEV_KEY}"
+
+# A short fingerprint of the public key, so a backup can be recognised later.
+fingerprint="$(openssl pkey -in "${KEY_DIR}/developer_key.pem" -pubout -outform DER \
+  | sha256sum | cut -c1-16)"
+
+cat >&2 <<EOF
+
+Developer key created: .cache/keys/developer_key.der
+Public key fingerprint (SHA-256, first 16 hex digits): ${fingerprint}
+
+BACK IT UP NOW. Copy the folder .cache/keys/ to an encrypted place (a password
+manager attachment or an encrypted USB drive). Garmin rejects app updates that
+are signed with a different key; without this key you would have to publish a
+new app and re-add every entry on the watch. 'make nuke' deletes this folder.
+EOF