feat: workspace tooling for the MesaStack fork

Add one-shot scripts driving both forks from the workspace root:

- build-image:   frontend build + thin-overlay image build + verification
- verify-image:  static and runtime smoke tests (brand, API key prefix,
                 login, real key creation), always cleans up its container
- sync-upstream: bump both forks to a new upstream release, cutting fresh
                 v<version>-lofyer branches and replaying fork-only commits
- bootstrap:     clone the two forks into place after cloning this repo

Fork-only commit detection deliberately goes beyond 'git log --cherry-pick
--right-only', which re-replays upstream commits that were rebased or
squashed into the new release; commits contained by any upstream ref or tag
are dropped instead.

The forks stay as separate repositories rather than submodules so each keeps
a clean upstream history to rebase onto new releases.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

scripts/bootstrap

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+#
+# bootstrap: clone the two forks into this workspace.
+#
+# This repo intentionally tracks only the workspace-level tooling (AGENTS.md and
+# scripts/); the frontend and backend forks stay in their own repositories so we
+# keep clean upstream histories and can rebase onto new releases. Run this after
+# cloning the workspace to lay out:
+#
+#   gpustack-all-lofyer/
+#   ├── gpustack-ui-lofyer/   frontend fork
+#   └── gpustack-lofyer/      backend fork
+#
+# Usage:
+#   scripts/bootstrap                 # clone both, checkout the default version
+#   scripts/bootstrap v2.2.1          # checkout a specific v<version>-lofyer
+#
+# Existing clones are left alone (only their remotes are verified).
+#
+set -o errexit
+set -o nounset
+set -o pipefail
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib/common.sh"
+
+# Keep in sync with the version table in AGENTS.md.
+DEFAULT_VERSION="v2.2.1"
+VERSION="${1:-${DEFAULT_VERSION}}"
+BRANCH="${VERSION}-lofyer"
+
+require_cmd git
+
+clone_fork() {
+  local name="${1}" dir="${2}" origin="${3}" upstream="${4}"
+
+  step "${name}"
+  if [[ -d "${dir}/.git" ]]; then
+    log "already present at ${dir}"
+  else
+    log "cloning ${origin}"
+    git clone "${origin}" "${dir}"
+  fi
+
+  if git -C "${dir}" remote get-url upstream >/dev/null 2>&1; then
+    git -C "${dir}" remote set-url upstream "${upstream}"
+  else
+    git -C "${dir}" remote add upstream "${upstream}"
+  fi
+  log "origin  : $(git -C "${dir}" remote get-url origin)"
+  log "upstream: $(git -C "${dir}" remote get-url upstream)"
+
+  local current
+  current="$(repo_branch "${dir}")"
+  if [[ "${current}" == "${BRANCH}" ]]; then
+    log "already on ${BRANCH}"
+  elif git -C "${dir}" rev-parse -q --verify "refs/heads/${BRANCH}" >/dev/null; then
+    git -C "${dir}" checkout "${BRANCH}"
+  elif git -C "${dir}" rev-parse -q --verify "refs/remotes/origin/${BRANCH}" >/dev/null; then
+    git -C "${dir}" checkout -b "${BRANCH}" "origin/${BRANCH}"
+  else
+    warn "branch ${BRANCH} not found (staying on ${current}); fetch or pick another version"
+  fi
+}
+
+clone_fork "Frontend" "${UI_REPO}" "${UI_ORIGIN_URL}" "${UI_UPSTREAM_URL}"
+clone_fork "Backend"  "${BACKEND_REPO}" "${BACKEND_ORIGIN_URL}" "${BACKEND_UPSTREAM_URL}"
+
+step "Done"
+log "frontend: $(repo_branch "${UI_REPO}")"
+log "backend : $(repo_branch "${BACKEND_REPO}")"
+cat <<EOF
+
+Next steps:
+  cd ${UI_REPO} && pnpm install    # or npm install, per the frontend repo
+  scripts/build-image              # build + verify the container image
+EOF