epic: Modernize Justfile for developer experience

## Summary The current Justfile is 709 lines of monolithic CI-focused plumbing. A new contributor runs `just --list` and sees 23 recipes with no obvious starting point — most are internal pipeline machinery (rechunk, gen-sbom, setup-cache, generate-build-tags). ## Goals 1. **Simple commands for humans** — `just dev`, `just lint`, `just test` as the primary interface 2. **Hide CI plumbing** — mark pipeline-only recipes `[private]` or split into imports 3. **Fast feedback loop** — streamlined local iteration (skip verification and rechunk, not offline) 4. **Discoverability** — better groups, prerequisite checks, getting-started help ## Design Principles - **Security boundary stays intact** — `just dev` must be a separate code path from CI builds, not a flag toggle. CI/release builds always force full verification. - **Rename migrations must be atomic** — any recipe rename (e.g. `check` → `fmt-check`) must update CI workflows in the same PR to avoid breakage. - **Add wrappers first, refactor later** — new recipes (`dev`, `lint`, `test`) ship before hiding/splitting/renaming existing ones. ## Child Issues ### Priority 1 — Foundation - [ ] #4714 `just deps` — prerequisite checker (must land before dev) - [ ] #4712 `just lint` — unified linting (pre-commit + shellcheck + just fmt check) - [ ] #4711 `just dev` — streamlined local build (skip verification + rechunk, still needs network for base images) ### Priority 2 — Developer Experience - [ ] #4710 `just test` — run image tests against local build - [ ] #4715 `just fmt` / `just fmt-check` — rename current check/fix (atomic with CI update) - [ ] #4713 `just help` — print getting-started guide ### Priority 3 — Cleanup & Maintainability - [ ] #4718 Hide CI-only recipes from `--list` - [ ] #4716 Split into imported justfiles (ci.just, admin.just) - [ ] #4717 Replace positional 0/1 flags with named boolean args - [ ] #4719 Rename groups to Dev, CI, Admin - [ ] #4721 `just diff` — show package delta vs upstream (requires network) - [ ] #4720 `just validate-scripts` — internal to `just lint`, not top-level ## Sequencing Constraints 1. `just deps` before `just dev` (can't dev without knowing what's missing) 2. New wrapper recipes before any renames/hides (don't break existing usage) 3. `just fmt-check` rename must include CI workflow update in same PR 4. Split/imports last — after public API is stable ## Current State | Group | Recipes | Purpose | |-------|---------|---------| | Image | 8 | Build, rechunk, load, run | | Utility | 11 | Validation, tagging, SBOM, cosign | | Just | 2 | check / fix (syntax only) | | Admin | 1 | GHCR retagging | | Changelogs | 1 | Changelog generation | ## Proposed `just --list` After ``` Dev: dev Build image locally (streamlined, no verification/rechunk) lint Run all linters (pre-commit, shellcheck, actionlint, just fmt) run Shell into the built image test Run image tests against local build clean Remove build artifacts fmt Fix Just/shell formatting fmt-check Check formatting without fixing deps Check prerequisites help Getting started guide Admin: retag-nvidia-on-ghcr Retag images on GHCR changelogs Generate changelogs secureboot Verify secureboot signatures diff Show package delta vs upstream ``` CI recipes hidden by default (visible with `just --list-all`).