Phase 1: CKPool build infrastructure

Forks CKPool-solo at upstream commit cfb0f83b (v1.0) via a multi-stage
Docker build, with an env-driven entrypoint that renders ckpool.conf from
a template. The pinned commit already includes every fix referenced in
Bassin issue #29 (workbase_id double increment, extended low-power
timeouts, configurable dropidle, vardiff burst handling).

No patches are applied yet — the patches/ directory holds the workflow
and build wiring so Kamado-specific patches can be added incrementally.

Build is portable across aarch64/x86_64: yasm is intentionally omitted
so CKPool falls back to its C SHA256, and CFLAGS override drops upstream's
default -march=native. Runtime image ships ckpool and ckpmsg for socket
debugging; share logging (-L) is enabled by default.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ckpool/patches/README.md

@@ -0,0 +1,58 @@
+# CKPool Patches
+
+Patches applied on top of the upstream CKPool commit pinned in `../CKPOOL_COMMIT`.
+
+Patches are applied in alphabetical order by filename. Use a numeric prefix to enforce ordering:
+
+- `0001-short-description.patch`
+- `0002-another-fix.patch`
+
+## Current state
+
+**No patches are applied.** The pinned upstream commit (`cfb0f83b`, tagged
+as version 1.0) already includes every fix that Bassin issue #29 asked to
+backport, plus several improvements:
+
+| Upstream commit | What it fixes                                                  |
+| --------------- | -------------------------------------------------------------- |
+| `a439cf96`      | workbase_id double increment bug                               |
+| `590fb2a2`      | Extended timeouts for low-powered miners (NerdMiner, ESP32)    |
+| `b13f3eee`      | Configurable `dropidle` timeout (exposed via our env var)      |
+| `66db3aa3`      | Better vardiff for bursty hashers                              |
+| `130c755d`      | Fix unlikely fopen segfault                                    |
+| `0bd3d751`      | Consistent error field in mining.submit rejections             |
+| `988b2687`      | Version 1.0 — longstanding stability bump                      |
+
+Kamado therefore starts from a CKPool that is strictly ahead of what Bassin
+ships today.
+
+## When to add a patch
+
+Use this directory for:
+
+1. Fixes needed before they land upstream (and only after attempting
+   to submit upstream first).
+2. Kamado-specific behavior changes that would not be accepted upstream —
+   e.g. tighter integration hooks with `kamado-api`.
+3. Temporary workarounds with a clear removal plan, documented in the
+   patch commit message.
+
+Do NOT use this directory for:
+
+- Pure configuration changes (expose via the entrypoint env vars instead).
+- Build system tweaks (put those in the Dockerfile).
+
+## Creating a patch
+
+From a clean clone of upstream at the pinned commit:
+
+```sh
+git clone https://bitbucket.org/ckolivas/ckpool.git
+cd ckpool
+git checkout $(cat /path/to/KamadoPool/ckpool/CKPOOL_COMMIT)
+# ... make your changes ...
+git diff > /path/to/KamadoPool/ckpool/patches/0001-my-fix.patch
+```
+
+The Dockerfile applies each `*.patch` file in this directory with
+`git apply --verbose` during the build.