lux/kms: orphan history at f2e793bf8 (was: kms: wire luxfi/mpc as REK backend)

Squashes all pre-rewrite history into a single root commit. Previous tree:
- 14506 commits including upstream Infisical fork history
- Multiple merge chains carrying pre-purge content

Force-rewrite per disk-space reclamation discipline. GHCR images
(1.9.9, 1.9.11) remain immutable; their git lineage is no longer
materialized.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: bug
+assignees: ''
+
+---
+
+### Describe the bug
+A clear and concise description of what the bug is.
+
+### To Reproduce
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+### Expected behavior
+A clear and concise description of what you expected to happen.
+
+### Screenshots
+If applicable, add screenshots to help explain your problem.
+
+### Platform you are having the issue on:
+
+### Additional context
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,17 @@
+---
+name: Feature Request
+about: Let us now what feature you would want to have in KMS
+title: ''
+labels: 'feature request'
+assignees: ''
+
+---
+
+### Feature description
+A clear and concise description of what the feature should be.
+
+### Why would it be useful?
+Why would this feature be useful for KMS users? 
+
+### Additional context
+Add any other context about the problem here.

.github/pull_request_template.md

@@ -0,0 +1,25 @@
+# Description 📣
+
+<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. Here's how we expect a pull request to be : https://lux.network/docs/contributing/getting-started/pull-requests -->
+
+## Type ✨
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Improvement
+- [ ] Breaking change
+- [ ] Documentation
+
+# Tests 🛠️
+
+<!-- Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration. You may want to add screenshots when relevant and possible -->
+
+```sh
+# Here's some code block to paste some code snippets
+```
+
+---
+
+- [ ] I have read the [contributing guide](https://lux.network/docs/contributing/getting-started/overview), agreed and acknowledged the [code of conduct](https://lux.network/docs/contributing/getting-started/code-of-conduct). 📝
+
+<!-- If you have any questions regarding contribution, here's the FAQ : https://lux.network/docs/contributing/getting-started/faq -->

.github/workflows/build-lux-kms.yml

@@ -0,0 +1,79 @@
+name: Build KMS
+
+# Self-contained — calling hanzoai/.github/.github/workflows/docker-build.yml@main
+# via `secrets: inherit` triggers a cross-org startup_failure (organization
+# secrets aren't inherited across orgs even with `inherit`). Same pattern
+# already used by build-server-self.yml.
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: lux-build
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute tags
+        id: meta
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            {
+              echo "tags<<EOF"
+              echo "ghcr.io/luxfi/kms:v${VERSION}"
+              echo "ghcr.io/luxfi/kms:${VERSION}"
+              echo "ghcr.io/luxfi/kms:sha-${GITHUB_SHA:0:7}"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+          else
+            {
+              echo "tags<<EOF"
+              echo "ghcr.io/luxfi/kms:sha-${GITHUB_SHA:0:7}"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+          runner-amd64: luxfi-amd64
+          runner-arm64: luxfi-arm64
+          runner-deploy: lux-deploy-linux-amd64
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push (linux/amd64, with embedded SPA)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          build-args: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+          runner-amd64: luxfi-amd64
+          runner-arm64: luxfi-arm64
+          runner-deploy: lux-deploy-linux-amd64
+      - name: Summary
+        run: |
+          echo "### Build complete" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          echo '${{ steps.meta.outputs.tags }}' >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"

.github/workflows/build-server-self.yml

@@ -0,0 +1,53 @@
+name: Build KMS Server (self-contained)
+
+# Self-contained workflow — does NOT call hanzoai/.github reusable workflow.
+# Runs directly on the amd64 ARC pool to bypass the cross-org `secrets:
+# inherit` initialization failure that's blocking the standard pipeline.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'cmd/**'
+      - 'pkg/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'Dockerfile.server'
+      - '.github/workflows/build-server-self.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: lux-build
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push (linux/amd64, headless server)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.server
+          platforms: linux/amd64
+          build-args: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          push: true
+          tags: |
+            ghcr.io/luxfi/kms:server
+            ghcr.io/luxfi/kms:server-${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max