feat: ESLint, shell completions, Docker, nfpm packaging, CI/CD

- ESLint with typescript-eslint + prettier (eslint.config.js)
- Shell completions for bash and fish (scripts/generate-completions.ts)
- Multi-stage Dockerfile for bastion (fedora:43 + dnsmasq + node)
- nfpm.yaml for RPM/DEB packaging with bun-compiled binary
- Build scripts: build-rpm.sh, build-bastion.sh, publish-rpm/deb.sh
- Gitea Actions CI/CD: lint, typecheck, test, build, publish

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/scripts/build-rpm.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+cd "$PROJECT_ROOT"
+
+# Load .env if present
+if [ -f .env ]; then
+  set -a; source .env; set +a
+fi
+
+# Ensure tools are on PATH
+export PATH="$HOME/.npm-global/bin:$HOME/.bun/bin:$HOME/.local/bin:$PATH"
+
+echo "==> Running unit tests..."
+pnpm test:run
+echo ""
+
+echo "==> Building TypeScript..."
+pnpm build
+
+echo "==> Generating shell completions..."
+pnpm completions:generate
+
+echo "==> Bundling standalone binary..."
+mkdir -p dist
+rm -f dist/lab dist/lab-*.rpm dist/lab*.deb
+
+bun build src/cli/src/index.ts --compile --outfile dist/lab
+
+echo "==> Packaging RPM..."
+nfpm pkg --packager rpm --target dist/
+
+RPM_FILE=$(ls dist/lab-*.rpm 2>/dev/null | head -1)
+echo "==> Built: $RPM_FILE"
+echo "    Size: $(du -h "$RPM_FILE" | cut -f1)"
+rpm -qpi "$RPM_FILE"
+
+echo ""
+echo "==> Packaging DEB..."
+rm -f dist/lab*.deb
+nfpm pkg --packager deb --target dist/
+
+DEB_FILE=$(ls dist/lab*.deb 2>/dev/null | head -1)
+echo "==> Built: $DEB_FILE"
+echo "    Size: $(du -h "$DEB_FILE" | cut -f1)"