build: collapse compose, adopt bake, rewrite Makefile + CI (2/3)

[Coriou]

Summary

Second of three stacked PRs. Stacked on #1 — base is build/devx-overhaul-pr1; when #1 merges, GitHub will auto-rebase this onto main.

Lands Phases C + D + E + F: the contributor-visible workflow changes that make the new build system usable.

• Phase C (refactor(compose): collapse 4 files into single profile-driven compose.yaml) — replaces docker-compose.{dev,prod,override,demod-test}.yml and docker/Dockerfile.demod-test with a single root compose.yaml using v2 profiles: dev (sdrpp-server + wavekit-api), prod-single-host (wavekit-full image-only), prod-distributed (wavekit-sdrpp-prod + wavekit-core-prod image-only), demod-test (interactive final-demod). Every build: block declares cache_from pointing at ghcr.io/coriou/wavekit:cache-<stage> registry refs (cache misses fall through silently per Req 4.3). nginx-reverse-proxy and codercom/code-server services removed (Req 2.7 — both unused). packages/sdr-host/docker-compose.yml untouched (Non-negotiable 14).
• Phase D (build(bake): introduce GHCR-backed buildx bake pipeline) — adds docker/bake.hcl declaring 4 final targets (final, final-core, final-sdrpp, final-demod), 1 CI helper (ci-core), and 2 groups (default, demod). Each target's cache-from chain pulls per-stage refs; cache-to writes are gated by a CACHE_FROM_ONLY=true default (CI flips to false on main-branch push for mode=max writes). Multi-arch linux/amd64,linux/arm64 defaults. docker/build.sh and docker/platform-utils.sh deleted; docker/push.sh rewritten as a thin GHCR-only bake invocation using WAVEKIT_GH_OWNER env var (coriou fallback). docker/init.sh dropped the .docker-cache mkdir.
• Phase E (chore(make): trim Makefile to lifecycle-focused target inventory) — 386 → 156 lines, 63 → 34 targets. Headline DX commands: make dev (pnpm dev — native, no Docker), make dev-stack (compose dev profile), make docker-build (buildx bake default group). The 22 forbidden targets (Req 6.2) are gone (make dev-up/docker-dev/docker-build-{full,core,sdrpp}/etc.). No emoji or decorative ANSI in newly-introduced output.
• Phase F (ci: add docker-build job; bump Node to 22; Corepack-driven pnpm) — .github/workflows/ci.yml rewritten: lint-typecheck-test job runs full pnpm lint + typecheck + build + test on Node 22 via Corepack (previously missing the test step). New docker-build job depends on it, sets up QEMU + buildx (docker-container driver), runs docker/bake-action@v5. PR path: ci-core target multi-arch, cache-from only, no login, no push. Main path: log in to GHCR with GITHUB_TOKEN, build default group, push: true, CACHE_FROM_ONLY=false for mode=max cache-to writes.

Properties verified locally

• Property 11 (no plain docker build): grep -rn '\bdocker build\b' docker/ Makefile compose.yaml | grep -v buildx → empty.
• Property 12 (single compose file): find . -maxdepth 1 -type f -name 'compose*.yaml' -o -name 'docker-compose*.yml' → only ./compose.yaml.
• Bake parses: docker buildx bake --file docker/bake.hcl --print default produces valid JSON with the expected default → [final, final-core, final-sdrpp] group.
• Single-arch warm bake: 36 s wall time, all stages CACHED on re-run.
• Multi-arch local bake: ci-core for linux/amd64,linux/arm64 succeeds (46 min cold under QEMU; subsequent warm builds much faster once GHCR cache populated by main-branch push).
• docker compose --profile dev up --build end-to-end: wavekit-api reaches healthy, curl localhost:9000/health returns 200.

Notable deviations (documented inline in code)

• sdrpp-server healthcheck: switched from design's HTTP curl :5259/ to TCP-port probe via bash -c '</dev/tcp/localhost/5259'. SDR++ in server mode speaks the binary RTL-TCP protocol on 5259, not HTTP — curl never succeeds. The TCP-reachability probe matches the actual contract.
• wavekit-api port mapping: 9000:3000 (not 9000:9000 as in design.md §3) because config/default.yaml has api.port=3000 and the s6 run script doesn't use with-contenv to inherit container env. Matches the legacy make dev-up pattern. The container-internal healthcheck probes localhost:3000/health accordingly.
• docker/scripts/start-sdrpp.sh: removed --log-level info (one-line surgical fix; pre-existing bug surfaced by Phase B's corrected SDR++ install path — the flag triggers a basic_string from null std::logic_error on SDR++ v1.1.0). Without this fix, the dev profile's end-to-end test couldn't pass.

Deferred

• D.8 (initial GHCR cache seed): a one-time docker buildx bake … --push --cache-to mode=max bootstrap from a local machine. Deferred — Phase F's CI workflow seeds the cache via the same mechanism on the first main-branch push after this PR merges, making the manual seed redundant. Cold PR builds before that first main push will use the Req 4.3 "no cache" fallback (~25-40 min on first PR; subsequent PRs ~2-5 min once cache is live).
• F.7 (live draft-PR smoke): the CI's GHCR cache-from path can only be fully validated against a live GHCR cache. Per the plan's R5 mitigation, this PR opening IS that smoke test — the docker-build job's cold-cache PR build is the validation.

Test plan

• CI green on both lint-typecheck-test and docker-build jobs for this PR
• Reviewer confirms compose.yaml profiles parse cleanly: for p in dev prod-single-host prod-distributed demod-test; do docker compose --profile $p config -q; done exits 0 for each
• Reviewer confirms make help lists only the canonical inventory + sdr-host-* + fixtures-*
• Reviewer confirms the bake's default group → [final, final-core, final-sdrpp] and the demod group → [final-demod]
• Reviewer confirms .github/workflows/ci.yml PR path has no login/push: true/cache-to=type=registry, and main path has all three

Spec

.kiro/specs/build-devx-overhaul/tasks.md Phase C/D/E/F sections checked off. D.8 and F.7 marked DEFERRED with rationale.