build: add Docker-only Makefile, SDK setup and product manifest

- Makefile: every target runs in a container as your UID/GID, with no
  capabilities, a read-only root filesystem, only the project folder
  mounted and no network except for image builds and `make sdk`.
  Serial even under `make -j`. `make nuke` removes containers, images,
  the dedicated buildx builder and .cache/ after confirmation.
- sdk-setup.sh: agreement acceptance pinned to the hash you read,
  password login (never stored), SDK 9.2.0 and device download, and
  the login token deleted afterwards.
- gen-key.sh: RSA-4096 developer key into .cache/keys, never
  overwritten, with backup instructions.
- manifest.xml: watch-app, minApiLevel 5.0.0, no permissions, and the
  72 watches with API 5.0+ and at least 512 KB for apps.
- .gitignore, lint configs and CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 96 insertions, 0 deletions

diff --git a/manifest.xml b/manifest.xml
new file mode 100644
index 0000000..cffbe88
--- /dev/null
+++ b/manifest.xml
@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Connect IQ manifest for OTP Wallet (README sections 4 and 14).
+
+  * type watch-app with minApiLevel 5.0.0: device app, so it never times out
+    like a widget, and it can provide a glance on API 4.0+ watches.
+  * No permissions at all, so the app cannot use Toybox.Communications or any
+    other network API. Keep it that way: it is part of the security design.
+  * Products: every watch with API level 5.0 or newer and at least 512 KB of
+    memory for watch apps (72 devices). tools/gen_products.py checks
+    this list against the downloaded device files (`make products`).
+-->
+<iq:manifest version="3" xmlns:iq="http://www.garmin.com/xml/connectiq">
+    <iq:application id="7e21a3c58041450f913f86cf584c5945" type="watch-app" name="@Strings.AppName"
+        entry="OtpWalletApp" launcherIcon="@Drawables.LauncherIcon" minApiLevel="5.0.0">
+        <iq:products>
+            <iq:product id="approachs50"/>
+            <iq:product id="approachs7042mm"/>
+            <iq:product id="approachs7047mm"/>
+            <iq:product id="approachs7243mm"/>
+            <iq:product id="approachs7247mm"/>
+            <iq:product id="d2airx10"/>
+            <iq:product id="d2mach1"/>
+            <iq:product id="d2mach2"/>
+            <iq:product id="d2mach2pro"/>
+            <iq:product id="descentg2"/>
+            <iq:product id="descentmk343mm"/>
+            <iq:product id="descentmk351mm"/>
+            <iq:product id="enduro3"/>
+            <iq:product id="enduro4"/>
+            <iq:product id="epix2"/>
+            <iq:product id="epix2pro42mm"/>
+            <iq:product id="epix2pro47mm"/>
+            <iq:product id="epix2pro51mm"/>
+            <iq:product id="fenix7"/>
+            <iq:product id="fenix7pro"/>
+            <iq:product id="fenix7pronowifi"/>
+            <iq:product id="fenix7s"/>
+            <iq:product id="fenix7spro"/>
+            <iq:product id="fenix7x"/>
+            <iq:product id="fenix7xpro"/>
+            <iq:product id="fenix7xpronowifi"/>
+            <iq:product id="fenix843mm"/>
+            <iq:product id="fenix847mm"/>
+            <iq:product id="fenix8pro47mm"/>
+            <iq:product id="fenix8solar47mm"/>
+            <iq:product id="fenix8solar51mm"/>
+            <iq:product id="fenix943mm"/>
+            <iq:product id="fenix947mm"/>
+            <iq:product id="fenix9pro43mm"/>
+            <iq:product id="fenix9pro47mm"/>
+            <iq:product id="fenix9pro51mm"/>
+            <iq:product id="fenix9prosolar47mm"/>
+            <iq:product id="fenix9prosolar51mm"/>
+            <iq:product id="fenixe"/>
+            <iq:product id="fr165"/>
+            <iq:product id="fr165m"/>
+            <iq:product id="fr170"/>
+            <iq:product id="fr170m"/>
+            <iq:product id="fr255"/>
+            <iq:product id="fr255m"/>
+            <iq:product id="fr255s"/>
+            <iq:product id="fr255sm"/>
+            <iq:product id="fr265"/>
+            <iq:product id="fr265s"/>
+            <iq:product id="fr57042mm"/>
+            <iq:product id="fr57047mm"/>
+            <iq:product id="fr70"/>
+            <iq:product id="fr955"/>
+            <iq:product id="fr965"/>
+            <iq:product id="fr970"/>
+            <iq:product id="instinct3amoled45mm"/>
+            <iq:product id="instinct3amoled50mm"/>
+            <iq:product id="instinctcrossoveramoled"/>
+            <iq:product id="marq2"/>
+            <iq:product id="marq2aviator"/>
+            <iq:product id="venu2"/>
+            <iq:product id="venu2plus"/>
+            <iq:product id="venu2s"/>
+            <iq:product id="venu3"/>
+            <iq:product id="venu3s"/>
+            <iq:product id="venu441mm"/>
+            <iq:product id="venu445mm"/>
+            <iq:product id="venusq2"/>
+            <iq:product id="venusq2m"/>
+            <iq:product id="venux1"/>
+            <iq:product id="vivoactive5"/>
+            <iq:product id="vivoactive6"/>
+        </iq:products>
+        <iq:permissions/>
+        <iq:languages>
+            <iq:language>eng</iq:language>
+        </iq:languages>
+        <iq:barrels/>
+    </iq:application>
+</iq:manifest>