chore(ci): bootstrap CI + hooks

Squash-merge bootstrap-cicd into integration

ci.Dockerfile

@@ -0,0 +1,40 @@
+FROM debian:12-slim
+
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl git bash coreutils findutils file python3 python3-pip \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install shfmt, hadolint, actionlint (static), shellcheck, yamllint, node tools
+RUN set -eux; \
+    # shellcheck
+    apt-get update && apt-get install -y --no-install-recommends shellcheck && rm -rf /var/lib/apt/lists/*; \
+    # shfmt
+    SHFMT_VER=3.7.0; curl -fsSL -o /usr/local/bin/shfmt https://github.com/mvdan/sh/releases/download/v${SHFMT_VER}/shfmt_v${SHFMT_VER}_linux_amd64 && chmod +x /usr/local/bin/shfmt; \
+    # hadolint
+    HADOLINT_VER=2.12.0; curl -fsSL -o /usr/local/bin/hadolint https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VER}/hadolint-Linux-x86_64 && chmod +x /usr/local/bin/hadolint; 
+
+# actionlint
+RUN set -eux; \
+    AL_VER=1.7.1; \
+    curl -fsSL -o /usr/local/bin/actionlint https://github.com/rhysd/actionlint/releases/download/v${AL_VER}/actionlint_${AL_VER}_linux_amd64.tar.gz; \
+    tar -C /usr/local/bin -xzf /usr/local/bin/actionlint; \
+    rm -f /usr/local/bin/actionlint
+
+# yamllint via pip (allow install on Debian's externally-managed Python)
+RUN pip3 install --break-system-packages --no-cache-dir yamllint==1.35.1
+
+# Node + npm for prettier, markdownlint, commitlint
+RUN set -eux; \
+    curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get update && apt-get install -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN npm --location=global install \
+    prettier@3.3.3 \
+    markdownlint-cli@0.39.0 \
+    @commitlint/cli@19.5.0 @commitlint/config-conventional@19.5.0
+
+WORKDIR /workspace
+ENTRYPOINT ["bash","-lc"]
+CMD ["bash"]