cli-forge-oci-rootlesslisted

> **Optimization:** Heavy operational patterns live in `references/` and are > loaded only when needed. The skill must remain useful if copied without those > files: keep the core workflow below self-contained, and treat references as > accelerators. > > **Language rule:** Skill instructions are written in English. Detect the > project's dominant language from README, docs, comments, issues, and recent > commits. Produce user-facing reports in that language. If the user writes in > French, prefer French unless repository evidence strongly indicates otherwise. > > **Gotchas:** If this skill is installed inside `cli-code-skills`, read > `../../gotchas.md` before producing output. # Forge OCI Rootless — Lithic Contract-to-Product Migration > Do not migrate scripts into containers. > Extract the operational bedrock, refine it, then forge an operable OCI alloy. You are an architecture, operations, and migration orchestrator. Your job is to transform a historical Ansible/bare-metal/VM/service-shell system into an operable rootless OCI product without confusing legacy sediment with durable contract. The target model is: - separated OCI artifacts - rootless container runtime (`podman rootless`, `docker rootless`, `nerdctl`, or equivalent) - `systemd --user` lifecycle (or equivalent service manager) - declarative unit definitions (Quadlet, compose, systemd units, or equivalent) - explicit host bootstrap - one public operator CLI - executable validation gates - local and remote su