chore(dev): add mise Guix and Wolfi Podman environments

[hyperpolymath]

Summary

Owner-requested tooling follow-up to merged #174 (trust-kernel migration, #173).

• Replace generic mise config with Just 1.58.0 and discovery of the canonical rust-toolchain.toml pin; provide Cargo tasks and real Just build/test/format/lint/fetch recipes.
• Add checksum-verified mise 2026.10.6 bootstrap for Linux x86_64/aarch64, with prerequisite checks and fail-closed installs.
• Add an authenticated pinned Guix channel and native prerequisite manifest, plus FHS environment instructions. Guix is explicitly opt-in at owner request despite older estate deprecation guidance.
• Use Chainguard Wolfi for development, builder and runtime Containerfile stages. Add a rootless Podman development wrapper with named caches and no privileged mode or engine-socket mount, plus build-context exclusions.
• Document fresh-checkout setup in docs/DEVELOPMENT.adoc, link from README and update the existing STATE descriptile. New files have MPL-2.0 SPDX headers; no new .a2ml files.

Validation

• PASS: bash syntax checks for bootstrap, Podman wrapper and offline tests.
• PASS: bash tests/dev-tools.sh — mocked existing install, download failure, checksum rejection, container build/run arguments and missing-image failure.
• PASS: git diff --check.
• BLOCKED: actual mise/Just installation; GitHub release binaries redirect to release-assets.githubusercontent.com, which the sandbox cannot reach.
• BLOCKED: Rust distribution server and cgr.dev registry are unreachable; Cargo/Just/Guix/Podman are absent, as are CMake/pkg-config prerequisites. Real cargo build/test, Guix evaluation and Podman build/run remain pending.
• Wolfi currently uses its rolling tag; digest override is supported but no unverified digest is invented. APK repositories are also rolling; not claimed bit-for-bit reproducible.
• These commits are unsigned: the sandbox lacks GPG tooling/key.

Existing CI blocker

The previous PR #174 run at 0896185 failed Cargo check (exit 101), with Cargo test skipped. Detailed logs redirect to an unavailable Actions host; the cause is undiagnosed, not assumed to be #166. This follow-up changes no application dependencies. Keep draft until real tool installation, Rust build/tests, Guix shell and container execution have been verified on an unrestricted host.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 05689310-187f-4146-9231-ba87955d1bb6

---

📥 Commits

Reviewing files that changed from the base of the PR and between 65f2e65 and d912d57.

---

📒 Files selected for processing (12)

• .containerignore
• .machine_readable/descriptiles/STATE.a2ml
• Containerfile
• Justfile
• README.adoc
• docs/DEVELOPMENT.adoc
• guix/channels.scm
• guix/manifest.scm
• mise.toml
• scripts/bootstrap.sh
• scripts/dev-container.sh
• tests/dev-tools.sh

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}