ci: add GitLab CI pipeline and rootfs smoke tests

- tests/: offline tree validation plus rootfs smoke tests that assert
  the hardening guarantees (kptr_restrict, default-deny firewall,
  key-only ssh, no snapd/telemetry, btrfs tooling).
- ci/: GitLab pipeline - validate, build matrix (server/workstation/
  cloud), smoke tests, publish on tags.

tests/run-tests.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Arcline OS — test runner
+#
+#   tests/run-tests.sh                    # validate tree + test built rootfs(s)
+#   tests/run-tests.sh server             # test a specific edition
+#
+# Verifies:
+#   1. the whole build tree is syntactically valid (validate.sh)
+#   2. any built rootfs in build/rootfs/<edition> satisfies the hardening
+#      and packaging guarantees (tests/smoke/verify-rootfs.sh)
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/../scripts/common.sh"
+
+fail=0
+
+log "step 1/2 — tree validation"
+"$ROOT/scripts/validate.sh" || fail=1
+
+log "step 2/2 — rootfs smoke tests"
+editions=("${EDITIONS[@]}")
+[[ $# -gt 0 ]] && editions=("$@")
+
+for e in "${editions[@]}"; do
+  rootfs="$ROOTFS_DIR/$e"
+  if [[ ! -d "$rootfs" ]]; then
+    warn "no rootfs for '$e' at $rootfs — skipping smoke test"
+    continue
+  fi
+  log "smoke testing rootfs: $e"
+  if ! "$ROOT/tests/smoke/verify-rootfs.sh" "$rootfs"; then
+    warn "smoke test failed for '$e'"
+    fail=1
+  fi
+done
+
+if [[ $fail -eq 0 ]]; then
+  log "tests passed ✓"
+else
+  die "tests failed"
+fi