chore: rebrand backone names, add lint gate + agent docs

- CI: build/validate use backone selftest + binary names, add lint.yml
- make-*.mk: emit/install backone binaries, drop zerotier-one paths
- doc/debian/ext.installfiles: backone manpages, service, init, te
- rule-compiler: npm test runs test.js; attic world planet files
- AGENTS.md repository guidelines, tools/lint.sh changed-lines gate
- gitignore: /backone-selftest, *.gcno, *.gcda

make-linux.mk

@@ -9,7 +9,7 @@ ifeq ($(origin CXX),default)
 	CXX:=$(shell if [ -e /opt/rh/devtoolset-8/root/usr/bin/g++ ]; then echo /opt/rh/devtoolset-8/root/usr/bin/g++; else echo $(CXX); fi)
 endif
 
-INCLUDES?=-Irustybits/target -isystem ext -Iext/prometheus-cpp-lite-1.0/core/include -Iext-prometheus-cpp-lite-1.0/3rdparty/http-client-lite/include -Iext/prometheus-cpp-lite-1.0/simpleapi/include
+INCLUDES?=-Irustybits/target -isystem ext -isystem ext/liboqs/include -Iext/prometheus-cpp-lite-1.0/core/include -Iext-prometheus-cpp-lite-1.0/3rdparty/http-client-lite/include -Iext/prometheus-cpp-lite-1.0/simpleapi/include
 DEFS?=
 LDLIBS?=
 DESTDIR?=
@@ -46,6 +46,15 @@ endif
 # Trying to use dynamically linked libhttp-parser causes tons of compatibility problems.
 ONE_OBJS+=ext/http-parser/http_parser.o
 
+# ext/liboqs 0.16.0 vendored: PQ objects (list in objects.mk), isolated flags
+override CORE_OBJS+=$(OQS_OBJS)
+OQS_CFLAGS=-isystem ext/liboqs/include -isystem ext/liboqs/src -isystem ext/liboqs/src/common/pqclean_shims \
+	-Iext/liboqs/src/kem/ml_kem/mlkem-native_ml-kem-768_ref \
+	-Iext/liboqs/src/sig/ml_dsa/mldsa-native_ml-dsa-65_ref \
+	-Iext/liboqs/src/common/sha3/xkcp_low/KeccakP-1600/plain-64bits \
+	-DMLK_CONFIG_PARAMETER_SET=768 -DMLK_CONFIG_FILE=\"../../integration/liboqs/config_c.h\" \
+	-DMLD_CONFIG_PARAMETER_SET=65 -DMLD_CONFIG_FILE=\"../../integration/liboqs/config_c.h\"
+
 ifeq ($(ZT_RULES_ENGINE_DEBUGGING),1)
 	override DEFS+=-DZT_RULES_ENGINE_DEBUGGING
 endif
@@ -319,6 +328,11 @@ ifeq ($(ZT_OFFICIAL),1)
 	CORE_OBJS+=ext/misc/linux-old-glibc-compat.o
 	override LDFLAGS+=-Wl,--wrap=memcpy -static-libstdc++
 endif
+ifeq ($(ZT_COVERAGE),1)
+	override CFLAGS+=--coverage
+	override CXXFLAGS+=--coverage
+	override LDFLAGS+=--coverage
+endif
 
 ifeq ($(ZT_CONTROLLER),1)
 	override CXXFLAGS+=-Wall -Wno-deprecated -std=c++17 -pthread $(INCLUDES) -DNDEBUG $(DEFS)
@@ -365,6 +379,8 @@ override CXXFLAGS+=-fPIC -fPIE
 
 # Non-executable stack
 override LDFLAGS+=-Wl,-z,noexecstack
+ext/liboqs/src/%.o: ext/liboqs/src/%.c
+	$(CC) $(CFLAGS) $(OQS_CFLAGS) -c -o $@ $<
 
 .PHONY: all
 all:	one