build: add Docker-only Makefile, SDK setup and product manifest

- Makefile: every target runs in a container as your UID/GID, with no
  capabilities, a read-only root filesystem, only the project folder
  mounted and no network except for image builds and `make sdk`.
  Serial even under `make -j`. `make nuke` removes containers, images,
  the dedicated buildx builder and .cache/ after confirmation.
- sdk-setup.sh: agreement acceptance pinned to the hash you read,
  password login (never stored), SDK 9.2.0 and device download, and
  the login token deleted afterwards.
- gen-key.sh: RSA-4096 developer key into .cache/keys, never
  overwritten, with backup instructions.
- manifest.xml: watch-app, minApiLevel 5.0.0, no permissions, and the
  72 watches with API 5.0+ and at least 512 KB for apps.
- .gitignore, lint configs and CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 88 insertions, 0 deletions

diff --git a/docker/scripts/sdk-setup.sh b/docker/scripts/sdk-setup.sh
new file mode 100755
index 0000000..278b060
--- /dev/null
+++ b/docker/scripts/sdk-setup.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Interactive first-time setup behind `make sdk` (README section 15.3).
+#
+#   1. Garmin's agreements: you read them in your browser and accept them here.
+#   2. Login with your Garmin account. Email and password are typed here and
+#      passed only to the SDK manager CLI, which sends them to Garmin's sign-in
+#      page. Neither is written to disk; the CLI stores an access token.
+#   3. Download Connect IQ SDK ${SDK_VERSION} and make it the current SDK.
+#   4. Download the device files and simulator fonts for every product listed
+#      in manifest.xml.
+#   5. Log out: delete the access token (set KEEP_LOGIN=1 to keep it).
+#
+# Why email and password instead of the CLI's browser login: that flow waits
+# for a redirect to a random localhost port inside the container, which your
+# browser can't reach without host networking (not allowed by the sandbox
+# rules). Password login doesn't support Garmin two-step verification; README
+# section 15.3 describes the fallback for such accounts.
+set -euo pipefail
+# shellcheck source=ciq-env.sh
+source "$(dirname "${BASH_SOURCE[0]}")/ciq-env.sh"
+
+readonly SDKMGR=connect-iq-sdk-manager
+readonly MANIFEST=/work/manifest.xml
+readonly TOKEN="${CIQ_HOME}/token.json"
+
+[[ -t 0 ]] || die "'make sdk' is interactive; run it from a terminal."
+[[ -f "${MANIFEST}" ]] || die "manifest.xml not found in the project folder."
+: "${SDK_VERSION:?SDK_VERSION is not set (the Makefile passes it)}"
+
+echo
+echo "Step 1/5: Garmin's agreements"
+view="$(${SDKMGR} agreement view 2>&1)" || die "Could not fetch the agreement from Garmin: ${view}"
+url="$(sed -n 's/^Agreement: //p' <<<"${view}")"
+hash="$(sed -n 's/^Current Hash: //p' <<<"${view}")"
+[[ -n "${url}" && -n "${hash}" ]] || die "Unexpected output from 'agreement view': ${view}"
+cat <<EOF
+  Please read the Garmin CONNECT IQ SDK License Agreement and the
+  CONNECT IQ Application Developer Agreement in your browser:
+    ${url}
+  Agreement version (hash): ${hash}
+EOF
+read -r -p "  Type 'accept' to accept them, or anything else to stop: " answer
+[[ "${answer}" == accept ]] || die "Agreements not accepted; nothing was downloaded."
+# Passing the hash makes the CLI refuse if Garmin changed the text since you read it.
+${SDKMGR} agreement accept --agreement-hash "${hash}" >/dev/null
+echo "  Accepted (version ${hash})."
+
+echo
+echo "Step 2/5: Garmin login"
+if [[ -f "${TOKEN}" ]]; then
+  echo "  Reusing the login token kept from an earlier run (KEEP_LOGIN=1)."
+else
+  echo "  Email and password go only to Garmin's sign-in page and are not stored."
+  echo "  Accounts with two-step verification can't log in this way (see README 15.3)."
+  read -r -p "  Garmin account email: " GARMIN_USERNAME
+  read -r -s -p "  Password (not shown): " GARMIN_PASSWORD
+  echo
+  export GARMIN_USERNAME GARMIN_PASSWORD
+  if ! ${SDKMGR} login; then
+    unset GARMIN_USERNAME GARMIN_PASSWORD
+    die "Login failed. Check email and password. Two-step verification isn't supported here; see README 15.3."
+  fi
+  unset GARMIN_USERNAME GARMIN_PASSWORD
+  echo "  Logged in."
+fi
+
+echo
+echo "Step 3/5: Connect IQ SDK ${SDK_VERSION}"
+${SDKMGR} sdk set "${SDK_VERSION}"
+echo "  Current SDK: $(${SDKMGR} sdk current-path)"
+
+echo
+echo "Step 4/5: device files and fonts for the products in manifest.xml"
+${SDKMGR} device download --manifest "${MANIFEST}" --include-fonts
+
+echo
+echo "Step 5/5: log out"
+if [[ "${KEEP_LOGIN:-0}" == 1 ]]; then
+  echo "  KEEP_LOGIN=1: keeping the token at .cache/home/.Garmin/ConnectIQ/token.json"
+else
+  rm -f "${TOKEN}"
+  echo "  Login token deleted. Run 'make sdk' again whenever new device files are needed."
+fi
+
+device_count="$(find "${CIQ_HOME}/Devices" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l)"
+echo
+echo "Done: SDK ${SDK_VERSION}, ${device_count} device folders, $(du -sh "${CIQ_HOME}" | cut -f1) in .cache/home."
+echo "Next: 'make key' (if you have no developer key yet), then 'make test'."