Add Solstice CI workflow with per-OS setup scripts

- Introduced `.solstice/workflow.kdl` for defining Solstice CI workflows, including Linux and illumos builds.
- Added `setup-linux.sh` and `setup-illumos.sh` scripts for per-OS environment preparation.
- Implemented `job.sh` as a legacy script hook for additional build steps.

.solstice/job.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Solstice CI legacy job script.
+# NOTE: All environment and package setup is handled by per-OS setup scripts
+# referenced in .solstice/workflow.kdl and executed by the workflow runner.
+# This script intentionally contains no setup logic.
+
+log() { printf "[job] %s\n" "$*" >&2; }
+
+main() {
+  # Keep a minimal representative build as a legacy hook. The workflow steps
+  # already perform fmt/clippy/build/test; this is safe to remove later.
+  log "building workflow-runner"
+  cargo build --release || cargo build
+  log "done"
+}
+
+main "$@"

.solstice/setup-illumos.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Solstice CI per-OS environment prepare (illumos / SunOS)
+# Installs baseline tools (curl, git, gtar, compilers, rust) where possible.
+
+log() { printf "[setup-illumos] %s\n" "$*" >&2; }
+
+install_packages() {
+  if command -v pkg >/dev/null 2>&1; then
+    # OpenIndiana / IPS
+    sudo pkg refresh || true
+    # Prefer GNU tar (gtar) to match runner expectations
+    sudo pkg install -v \
+      web/curl \
+      developer/build/gnu-make \
+      developer/gcc-13 \
+      developer/protobuf \
+      developer/clang \
+      archiver/gnu-tar \
+      developer/rustc || true
+    # CA certs where package exists
+    sudo pkg install -v web/ca-certificates || true
+    # mozilla-rootcerts when available
+    if command -v mozilla-rootcerts >/dev/null 2>&1; then
+      sudo mozilla-rootcerts install || true
+    fi
+  elif command -v pkgin >/dev/null 2>&1; then
+    # SmartOS/NetBSD pkgin
+    sudo pkgin -y update || true
+    sudo pkgin -y install curl gmake gcc protobuf clang gtar rust || true
+    sudo pkgin -y install mozilla-rootcerts || true
+    if command -v mozilla-rootcerts >/dev/null 2>&1; then
+      sudo mozilla-rootcerts install || true
+    fi
+  else
+    log "no known package manager found (pkg/pkgin); skipping installs"
+  fi
+}
+
+main() {
+  install_packages
+  # Prefer GNU tar on PATH when available
+  if command -v gtar >/dev/null 2>&1 && ! command -v tar >/dev/null 2>&1; then
+    ln -sf "$(command -v gtar)" "$HOME/bin/tar" 2>/dev/null || true
+  fi
+}
+
+main "$@"

.solstice/setup-linux.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Solstice CI per-OS environment prepare (Linux)
+# Installs baseline tools needed by the workflow runner and builds.
+
+log() { printf "[setup-linux] %s\n" "$*" >&2; }
+
+export DEBIAN_FRONTEND=${DEBIAN_FRONTEND:-noninteractive}
+
+detect_pm() {
+  if command -v apt-get >/dev/null 2>&1; then echo apt; return; fi
+  if command -v dnf >/dev/null 2>&1; then echo dnf; return; fi
+  if command -v yum >/dev/null 2>&1; then echo yum; return; fi
+  if command -v zypper >/dev/null 2>&1; then echo zypper; return; fi
+  if command -v apk >/dev/null 2>&1; then echo apk; return; fi
+  if command -v pacman >/dev/null 2>&1; then echo pacman; return; fi
+  echo none
+}
+
+install_packages() {
+  local pm; pm=$(detect_pm)
+  case "$pm" in
+    apt)
+      sudo -n true 2>/dev/null || true
+      sudo apt-get update -y || apt-get update -y || true
+      sudo apt-get install -y --no-install-recommends \
+        curl ca-certificates git build-essential pkg-config libssl-dev \
+        protobuf-compiler cmake clang libclang-dev || true
+      ;;
+    dnf)
+      sudo dnf install -y curl ca-certificates git gcc gcc-c++ make pkgconf-pkg-config openssl-devel protobuf-compiler clang clang-libs || true
+      ;;
+    yum)
+      sudo yum install -y curl ca-certificates git gcc gcc-c++ make pkgconfig openssl-devel protobuf-compiler clang clang-libs || true
+      ;;
+    zypper)
+      sudo zypper --non-interactive install curl ca-certificates git gcc gcc-c++ make pkg-config libopenssl-devel protobuf clang || true
+      ;;
+    apk)
+      sudo apk add --no-cache curl ca-certificates git build-base pkgconfig openssl-dev protoc clang clang-libs || true
+      ;;
+    pacman)
+      sudo pacman -Sy --noconfirm curl ca-certificates git base-devel pkgconf openssl protobuf clang || true
+      ;;
+    *)
+      log "unknown package manager ($pm); skipping package install"
+      ;;
+  esac
+}
+
+ensure_rust() {
+  if command -v cargo >/dev/null 2>&1; then return 0; fi
+  log "installing Rust toolchain with rustup"
+  curl -fsSL https://sh.rustup.rs | sh -s -- -y
+  # shellcheck disable=SC1091
+  if [ -f "$HOME/.cargo/env" ]; then . "$HOME/.cargo/env"; else export PATH="$HOME/.cargo/bin:$PATH"; fi
+}
+
+main() {
+  install_packages
+  ensure_rust
+  if ! command -v protoc >/dev/null 2>&1; then
+    log "WARNING: protoc not found; prost/tonic builds may fail"
+  fi
+}
+
+main "$@"

.solstice/workflow.kdl

@@ -0,0 +1,23 @@
+workflow name="Solstice CI for solstice-ci" {
+    // Linux build and test on Ubuntu 22.04 runner
+    job id="linux-build" runs_on="ubuntu-22.04" {
+        setup path=".solstice/setup-linux.sh"
+        step name="Show toolchain" run="rustc -Vv && cargo -V"
+        step name="Format"         run="cargo fmt --check"
+        step name="Clippy"         run="cargo clippy --workspace --all-targets --all-features -- -D warnings"
+        step name="Build"          run="cargo build --workspace"
+        step name="Test"           run="cargo test --workspace --all-targets"
+        // Legacy script hook (runs after all other tests)
+        step name="Legacy job.sh"  run=".solstice/job.sh"
+    }
+
+    // Illumos build (bhyve zone). Keep steps minimal; clippy/format may vary per toolchain.
+    job id="illumos-build" runs_on="illumos-latest" {
+        setup path=".solstice/setup-illumos.sh"
+        step name="Show toolchain" run="rustc -Vv && cargo -V"
+        step name="Build"          run="cargo build --workspace"
+        step name="Test"           run="cargo test --workspace --all-targets"
+        // Legacy script hook (runs after all other tests)
+        step name="Legacy job.sh"  run=".solstice/job.sh"
+    }
+}