chore(project): bootstrap Deno workspace and CI

[wax911]

Background

AniTrend/stackctl is the standalone Deno CLI that will replace the repository-local stackctl.sh workflow currently used by AniTrend/local-stack. The project should be built as a Deno 2.x CLI with compiled release binaries for macOS and Linux.

The repository is currently empty, so this issue establishes the base project structure, CI, formatting, linting, tests, and release-ready build tasks.

Goals

• Add a root deno.json as the source of truth for imports, tasks, lint, format, permissions, tests, and workspace modules.
• Add deno.lock.
• Add src/main.ts with a minimal CLI entrypoint that can print --help and --version.
• Add workspace-style modules under src/* so later work can be split cleanly.
• Prefer JSR packages over npm packages.
• Add CI for cache, format check, lint, type check, tests, and coverage.
• Add build tasks for local and cross-platform compiled binaries.

Required structure

src/
  cli/
  config/
  compose/
  docker/
  env/
  process/
  secrets/
  testing/
fixtures/
docs/
.github/workflows/

Deno requirements

• Use Deno 2.x.
• Use deno.json task names:
  • cache
  • check
  • fmt
  • fmt:check
  • lint
  • test
  • coverage
  • build
  • build:darwin:x64
  • build:darwin:arm64
  • build:linux:x64
  • build:linux:arm64
• Configure permissions explicitly. Do not use --allow-all.
• Compile permissions should allow read/write/env/sys and only the external commands required by future stackctl commands: docker, sops, age, age-keygen, shred, rm.

Suggested imports

{
  "@cliffy/command": "jsr:@cliffy/command@^1.0.0",
  "@std/assert": "jsr:@std/assert@^1.0.18",
  "@std/dotenv": "jsr:@std/dotenv@^0.225.6",
  "@std/fs": "jsr:@std/fs@^1.0.0",
  "@std/path": "jsr:@std/path@^1.1.4",
  "@std/testing": "jsr:@std/testing@^1.0.17",
  "@std/yaml": "jsr:@std/yaml@^1.1.1"
}

CI requirements

Create .github/workflows/ci.yml with:

• Checkout
• Setup Deno
• deno task cache
• deno task fmt:check
• deno task lint
• deno task check
• deno task test
• deno task coverage

Acceptance criteria

• deno task fmt:check passes.
• deno task lint passes.
• deno task check passes.
• deno task test passes.
• deno task build:linux:x64 produces a runnable stackctl binary.
• stackctl --help and stackctl --version work from the compiled binary.

Notes

The repository currently defaults to main. Decide in this PR whether stackctl should keep main or switch to the broader AniTrend dev-first workflow before release automation is added.