Implement high-impact improvements based on ChatGPT feedback

SAFETY IMPROVEMENTS:
- Strengthen safety warnings with 🚨 emoji and mandatory confirmation
- Add BOOTC_CONFIRM_DISK_WIPE=1 requirement for destructive operations
- Add 10-second sleep before exit to prevent accidental execution
- Emphasize experimental nature and data loss risks

COMPATIBILITY MATRIX:
- Create detailed version compatibility table with specific versions
- Add feature compatibility by bootc version
- Include kernel requirements for each feature
- Document experimental flags and their version requirements

KERNEL REQUIREMENTS:
- Add comprehensive kernel feature checklist
- Include verification commands for kernel features
- Specify exact kernel versions for different features
- Add EROFS, composefs, overlayfs, fsverity requirements

LICENSING:
- Add Apache 2.0 LICENSE file with SPDX identifier
- Remove ambiguity about licensing terms

CI/AUTOMATION:
- Add GitHub Actions workflow for automated testing
- Test base image building and validation
- Test nginx layer creation
- Validate documentation structure
- Check for broken links and markdown syntax

This addresses the most critical feedback while maintaining focus
on what actually works (Sid/Forky + modern OSTree).

COMPATIBILITY.md

@@ -2,18 +2,30 @@
 
 This document provides compatibility information for bootc on Debian systems.
 
-## Tested Versions
+## Verified Compatibility Matrix
 
-| Component | Version | Notes |
-|-----------|---------|-------|
-| **bootc** | v1.1.4+ | Tested with main branch |
-| **Debian Base** | 13 (Trixie) | Recommended (stable) |
-| **Debian Base** | 14 (Forky) | Ideal (testing, latest OSTree) |
-| **Debian Base** | 12 (Bookworm) | Not recommended (oldstable, old OSTree) |
-| **Kernel** | 6.1+ | Minimum for basic features |
-| **Podman** | 4.0+ | Required for container operations |
-| **OSTree** | 2024.1+ | Required for deployments (Trixie+) |
-| **OSTree** | 2023.1+ | Minimum (Bookworm has older version) |
+| Component | Minimum Version | Tested Version | Notes |
+|-----------|----------------|----------------|-------|
+| **bootc** | v1.1.4 | v1.1.4 | Main branch, composefs-backend experimental |
+| **Debian Base** | Sid (unstable) | Sid | Recommended for base image building |
+| **Debian Base** | 14 (Forky) | 14 (Forky) | Ideal (testing, latest OSTree) |
+| **Debian Base** | 13 (Trixie) | 13 (Trixie) | Stable, may need OSTree backports |
+| **Debian Base** | 12 (Bookworm) | ❌ | Not supported (OSTree too old) |
+| **Kernel** | 6.1 | 6.5+ | Minimum 6.1, 6.5+ for composefs features |
+| **Podman** | 4.0 | 4.0+ | Required for container operations |
+| **OSTree** | 2024.1 | 2024.3+ | Required for deployments |
+| **composefs** | N/A | Experimental | Requires kernel 6.5+ for full features |
+
+## Feature Compatibility by bootc Version
+
+| Feature | bootc Version | Kernel Requirement | Notes |
+|---------|---------------|-------------------|-------|
+| Basic install | v1.1.4+ | 6.1+ | Manual installation recommended |
+| Composefs backend | v1.1.4+ | 6.5+ | Experimental, requires feature flag |
+| `--progress-fd` | v1.1.4+ | Any | Experimental flag |
+| `--no-signature-verification` | v1.1.4+ | Any | Bypasses security checks |
+| `--mutate-in-place` | v1.1.4+ | Any | In-place mutations |
+| `--json` output | v1.1.4+ | Any | JSON format output |
 
 ## Feature Compatibility
 
@@ -39,17 +51,44 @@ This document provides compatibility information for bootc on Debian systems.
 - ⚠️ `--json` - JSON output format
 - ⚠️ `--target-no-signature-verification` - Target signature bypass
 
-## Composefs Backend Requirements
+## Kernel Requirements Checklist
 
-### Kernel Requirements
-- **Minimum**: Kernel 5.15+ for basic EROFS support
-- **Recommended**: Kernel 6.5+ for full composefs features
-- **Overlay/Verity**: Kernel 6.6+ for advanced integrity features
+### Basic bootc Requirements (Kernel 6.1+)
+- ✅ **OSTree support**: Basic OSTree operations
+- ✅ **Container runtime**: Podman/containerd support
+- ✅ **systemd**: Full systemd integration
+- ✅ **AppArmor**: Security labeling (Debian default)
+
+### Composefs Backend Requirements (Kernel 6.5+)
+- ✅ **EROFS**: Enhanced Read-Only File System support
+- ✅ **composefs**: Kernel composefs module
+- ✅ **overlayfs**: Overlay filesystem support
+- ✅ **fsverity**: File system verification
+- ⚠️ **Advanced verity**: Kernel 6.6+ for certain integrity modes
 
 ### Userspace Requirements
-- **composefs**: Userspace composefs tools
-- **EROFS**: Enhanced Read-Only File System support
+- **composefs tools**: Userspace composefs utilities
+- **EROFS support**: Enhanced Read-Only File System support
 - **fsverity**: File system verification support
+- **FUSE3**: For fallback mounting (if kernel support unavailable)
+
+### Kernel Feature Verification
+```bash
+# Check kernel version
+uname -r
+
+# Check for EROFS support
+grep EROFS /proc/filesystems
+
+# Check for composefs support
+grep composefs /proc/filesystems
+
+# Check for overlayfs support
+grep overlay /proc/filesystems
+
+# Check for fsverity support
+grep fsverity /proc/filesystems
+```
 
 ### Feature Flags
 - `composefs-backend` - Enable composefs backend