feat: ship Rust login manager and GitLab release pipeline

Replace the legacy Go implementation as the production path, quarantine the reference tree, add deterministic release packaging and version metadata, and run verification through GitLab CI.

.gitlab-ci.yml

@@ -0,0 +1,127 @@
+stages:
+  - verify
+  - container
+  - package
+  - release
+
+workflow:
+  rules:
+    - if: '$CI_COMMIT_TAG'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH'
+
+variables:
+  CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
+  CARGO_TERM_COLOR: never
+  RUST_BACKTRACE: "1"
+
+.rust-job:
+  image: rust:1.88.0-bookworm
+  before_script:
+    - apt-get update
+    - >-
+      apt-get install --no-install-recommends -y
+      libpam0g-dev libpam-modules pkg-config xauth xvfb util-linux
+    - rustup component add rustfmt clippy
+  cache:
+    key:
+      files:
+        - Cargo.lock
+        - rust-toolchain.toml
+    paths:
+      - .cargo/registry/index/
+      - .cargo/registry/cache/
+      - .cargo/git/db/
+      - .cargo/bin/
+      - target/
+
+rust-verify:
+  extends: .rust-job
+  stage: verify
+  script:
+    - make check COLOR=0
+    - make version COLOR=0
+  artifacts:
+    when: always
+    expire_in: 7 days
+    paths:
+      - target/debug/deps/
+
+security-audit:
+  image: rust:1.88.0-bookworm
+  stage: verify
+  cache:
+    key: cargo-audit-0.22.2
+    paths:
+      - .cargo/bin/
+      - .cargo/registry/index/
+      - .cargo/registry/cache/
+  before_script:
+    - command -v cargo-audit >/dev/null || cargo install cargo-audit --locked --version 0.22.2
+  script:
+    - cargo audit
+
+docker-verify:
+  image: docker:27.5.1-cli
+  stage: container
+  services:
+    - name: docker:27.5.1-dind
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2376
+    DOCKER_TLS_CERTDIR: "/certs"
+    DOCKER_TLS_VERIFY: "1"
+    DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
+  before_script:
+    - until docker info >/dev/null 2>&1; do sleep 1; done
+  script:
+    - ./scripts/test-docker.sh
+  rules:
+    - if: '$CI_COMMIT_BRANCH'
+    - if: '$CI_COMMIT_TAG'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+
+package:
+  extends: .rust-job
+  stage: package
+  needs:
+    - job: rust-verify
+      artifacts: false
+    - job: docker-verify
+      artifacts: false
+    - job: security-audit
+      artifacts: false
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
+  script:
+    - VERSION="${CI_COMMIT_TAG#v}" make package COLOR=0 TAG="$CI_COMMIT_TAG"
+    - (cd dist && sha256sum --check "$(basename "$(ls *.tar.gz)").sha256")
+    - printf 'PACKAGE_JOB_ID=%s\n' "$CI_JOB_ID" >> dist/release.env
+  artifacts:
+    name: "latchd-${CI_COMMIT_TAG}"
+    expire_in: 30 days
+    paths:
+      - dist/
+    reports:
+      dotenv: dist/release.env
+
+release:
+  image: registry.gitlab.com/gitlab-org/cli:v1.103.0
+  stage: release
+  needs:
+    - job: package
+      artifacts: true
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/'
+  script:
+    - test -n "$PACKAGE_JOB_ID"
+    - test -f dist/release.env
+  release:
+    tag_name: "$CI_COMMIT_TAG"
+    name: "latchd ${CI_COMMIT_TAG}"
+    description: "Production artifacts and checksums are attached from the reproducible package job."
+    assets:
+      links:
+        - name: "latchd package and SHA-256"
+          url: "${CI_PROJECT_URL}/-/jobs/${PACKAGE_JOB_ID}/artifacts/download?file_type=archive"
+          link_type: package