[WAF-71] Package binaries, libraries, containers, system services, and Helm deployment

[chrisbbreuer]

Objective

Package Linux x86_64 and aarch64 artifacts, macOS development builds, C libraries, containers, Kubernetes and Helm, systemd, checksums, signatures, SBOMs, and upgrades.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-04
• WAF-43
• WAF-44
• WAF-45
• WAF-46
• WAF-47
• WAF-50
• WAF-60

Blocks

• WAF-72
• WAF-73

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry