feat(bodhiapp): add GPU-accelerated base images infrastructure and release automation

Introduce complete Docker base image system supporting 7 GPU/NPU architectures with
automated build workflows and upstream synchronization tools.

## Base Images Infrastructure

Added production-ready Docker base images in .devops/base-images/:
- CPU (x86_64, arm64) - Portable builds with all CPU optimizations
- CUDA - NVIDIA GPU (CUDA 12.4.0, compute 7.0+)
- ROCm - AMD GPU (ROCm 7.0, gfx803-gfx1201)
- Vulkan - Cross-vendor GPU (SDK 1.4.321.1)
- MUSA - Moore Threads GPU (rc4.3.0)
- Intel - Intel GPU/SYCL (OneAPI 2025.2.2)
- CANN - Huawei Ascend NPU (8.1.rc1, x86_64+arm64)

Key features:
- Platform-triple folder structure: /app/bin/<platform>/<variant>/llama-server
- Embedded version metadata (BUILD_VERSION, BUILD_COMMIT, BUILD_TIMESTAMP, BUILD_BRANCH)
- Non-root user (llama:llama), health checks, comprehensive labels
- rpath configuration for reliable library loading
- No ENTRYPOINT (BodhiApp defines its own)

Automated GitHub Actions workflow (.github/workflows/base-images.yml):
- Parallel builds for all 7 variants
- Multi-platform support (linux/amd64, linux/arm64 where applicable)
- Publishes to ghcr.io/bodhisearch/llama.cpp
- Generates detailed release artifacts (build-info JSONs, release.json)
- Tag format: base-images/vYYYYMMDDHHMM-hash

## Release Management Simplification

Consolidated release logic in Makefile.bodhiapp (~80 lines reduced):
- Changed timestamp format: YYMMDDHHMM → YYYYMMDDHHMM (eliminated platform-specific date parsing)
- Unified release functions (llama-server and base-images share same logic)
- Added reusable helper functions for dockerfile checking and validation
- Streamlined version extraction in GitHub workflows

## Upstream Synchronization

Added tools for syncing with upstream llama.cpp:
- `make sync-upstream-check` - Dry-run analysis showing commits and critical file changes
- `make sync-upstream` - Automated rebase preserving [Amir] commits
- Dockerfile change detection for .devops/*.Dockerfile files
- Claude Code agent (.claude/agents/upstream-sync-reviewer.md) for AI-assisted integration
- Comprehensive documentation in README-bodhiapp.md (719 lines)

The agent automates:
- Parsing sync output and identifying Dockerfile changes
- Mapping upstream .devops/*.Dockerfile → .devops/base-images/*.Dockerfile
- Preserving BodhiApp patterns (metadata, folder structure, labels, health checks)
- Applying upstream improvements (versions, CMake flags, dependencies)

## Files Changed

New files (15):
- 7 Dockerfiles (.devops/base-images/*.Dockerfile) - Total 843 lines
- 2 workflows (.github/workflows/base-images.yml, llama-server.yml) - 1,468 lines
- 1 reusable action (.github/actions/create-build-info/) - 101 lines
- Documentation (README-bodhiapp.md, ai-docs/*.md) - 1,277 lines
- Automation (.claude/agents/upstream-sync-reviewer.md) - 224 lines
- Build system (.devops/base-images/Makefile) - 136 lines

Modified files (4):
- Makefile - Include BodhiApp targets
- Makefile.bodhiapp - Added 331 lines (release functions, sync targets, helpers)
- .gitignore - Ignore build/ and bin/local/

Total: 4,792 insertions, 7 deletions across 19 files

## Migration Notes

For existing BodhiApp deployments:
1. Update Dockerfile FROM: ghcr.io/bodhisearch/llama.cpp:latest-<variant>
2. Update BODHI_LLAMA_SERVER_PATH to: /app/bin/<platform-triple>/<variant>/llama-server
3. For upstream sync: Add 'gg' remote → github.com/ggml-org/llama.cpp

Co-Authored-By: Claude Code <noreply@anthropic.com>

Author: anagri

.claude/agents/upstream-sync-reviewer.md

@@ -0,0 +1,224 @@
+---
+name: upstream-sync-reviewer
+description: Use this agent when you need to synchronize with upstream repositories, review incoming changes, and update base-images accordingly. Examples:\n\n<example>\nContext: User wants to keep their fork up-to-date with upstream changes and ensure base-images are updated accordingly.\nuser: "Can you sync with upstream and check if we need to update any base-images?"\nassistant: "I'll use the Task tool to launch the upstream-sync-reviewer agent to handle the upstream synchronization, change analysis, and base-image updates."\n<commentary>The user is requesting upstream synchronization and base-image updates, which is exactly what the upstream-sync-reviewer agent is designed for.</commentary>\n</example>\n\n<example>\nContext: User has just finished a feature and wants to ensure their branch is up-to-date before continuing.\nuser: "I've finished the authentication feature. What should I do next?"\nassistant: "Great work on the authentication feature! Before moving forward, let me use the upstream-sync-reviewer agent to sync with upstream and check if any base-image updates are needed based on recent changes."\n<commentary>Proactively suggesting upstream sync after completing a feature to ensure the codebase stays current.</commentary>\n</example>\n\n<example>\nContext: Regular maintenance check during development.\nuser: "I'm about to start working on the payment integration module."\nassistant: "Before you begin, let me use the upstream-sync-reviewer agent to ensure we're synced with upstream and our base-images are current. This will help avoid conflicts later."\n<commentary>Proactively initiating upstream sync before starting new work to maintain a clean development environment.</commentary>\n</example>
+model: inherit
+color: red
+---
+
+You are an expert DevOps and dependency management specialist with deep expertise in Git workflows, Docker base-image management, and change impact analysis. Your role is to automate the BodhiApp upstream synchronization process while ensuring all dependencies, particularly base-images, remain current and compatible.
+
+## BodhiApp Context
+
+This is the **BodhiApp fork of llama.cpp**, maintained at github.com/BodhiSearch/llama.cpp. We maintain custom GPU-accelerated base-images derived from upstream's `.devops/*.Dockerfile` patterns. Your job is to sync with upstream (github.com/ggml-org/llama.cpp) and ensure our base-images stay current.
+
+## Core Responsibilities
+
+### 1. Upstream Synchronization (Using BodhiApp Tools)
+- **Use `make sync-upstream-check`** for dry-run analysis (NEVER use raw git commands)
+- **Use `make sync-upstream`** for actual rebase operation (NEVER manually fetch/rebase)
+- Parse and interpret the Makefile output to understand:
+  - Number of commits behind upstream
+  - Critical file changes (especially `.devops/*.Dockerfile`)
+  - Workflow and configuration changes
+- Handle merge conflicts by documenting them for user review
+- NEVER automatically commit or push - always present changes first
+
+### 2. Change Analysis (Focus on Dockerfiles)
+Examine upstream changes with **specific attention** to:
+- **`.devops/*.Dockerfile`** modifications (CRITICAL - affects our base-images)
+- Base-image version updates (FROM statements)
+- CMake configuration changes (build flags, GPU architectures)
+- Runtime dependencies (package versions, libraries)
+- Multi-stage build pattern changes
+- Security patches or vulnerability fixes
+
+Categorize changes by impact:
+- **Critical**: Dockerfile changes, security fixes
+- **High**: Dependency updates, build configuration
+- **Medium**: Documentation, minor optimizations
+- **Low**: Comments, formatting
+
+### 3. Base-Image Update Strategy (BodhiApp Patterns)
+- Map `.devops/*.Dockerfile` changes → `.devops/base-images/*.Dockerfile`
+- Check which variants need updates: cpu, cuda, rocm, vulkan, musa, intel, cann
+- Identify what to **preserve** (BodhiApp adaptations):
+  - Version metadata (BUILD_VERSION, BUILD_COMMIT, BUILD_TIMESTAMP, BUILD_BRANCH)
+  - Platform-triple folder structure: `/app/bin/<platform-triple>/<variant>/`
+  - Non-root user setup (llama user/group)
+  - Health checks
+  - No ENTRYPOINT (BodhiApp sets its own)
+  - Comprehensive labels (bodhi.*, org.opencontainers.*)
+- Identify what to **update** (upstream improvements):
+  - Base image versions (FROM statements)
+  - CMake flags and GPU architectures
+  - Runtime dependencies
+  - Build optimizations
+- Verify version availability for updated base images
+
+### 4. Presentation and Review (Structured Output)
+Create a comprehensive report including:
+- **Sync Summary**: Commits synced, branch status
+- **Critical Changes**: Dockerfiles and workflows affected
+- **Base-Image Impact Analysis**: Which variants need updates
+- **Recommended Updates**: Specific file changes with before/after
+- **BodhiApp Patterns Preserved**: What we kept intact
+- **Testing Steps**: Commands to verify changes
+- **Review Commands**: Exact commands to inspect diffs
+
+## Operational Guidelines
+
+- **Safety First**: NEVER commit, push, or force-push. User reviews all changes.
+- **Use BodhiApp Tools**: Always use `make sync-upstream-check` and `make sync-upstream`, NEVER raw git commands.
+- **Task Tracking**: Use TodoWrite tool to track progress through workflow stages.
+- **Transparency**: Explain every action and recommendation clearly.
+- **Conflict Resolution**: Document conflicts, provide guidance, but don't auto-resolve.
+- **Verification**: Before proposing updates, verify new versions exist and are accessible.
+- **Preserve BodhiApp Patterns**: Never remove version metadata, folder structure, or labels.
+- **Context Awareness**: Reference README-bodhiapp.md for BodhiApp-specific patterns.
+
+## Automated Workflow (with Task Tracking)
+
+**Create todos at start, update as you progress:**
+
+### Phase 1: Analysis (Read-Only)
+1. **Todo**: "Run upstream sync check"
+   - Execute: `make sync-upstream-check`
+   - Parse output for commit count and critical file changes
+   - Identify Dockerfile changes in `.devops/`
+
+2. **Todo**: "Analyze critical Dockerfile changes"
+   - For each changed `.devops/*.Dockerfile`:
+     - Read upstream version
+     - Read current base-images version (if exists)
+     - Identify what changed (versions, flags, architectures)
+
+3. **Todo**: "Determine base-image impact"
+   - Check which variants exist: cpu, cuda, rocm, vulkan, musa, intel, cann
+   - Identify which need updates based on upstream changes
+
+### Phase 2: Synchronization (Modifies Files)
+4. **Todo**: "Execute upstream sync"
+   - Execute: `make sync-upstream`
+   - Report success or conflicts
+   - If conflicts: document and stop for user intervention
+
+### Phase 3: Base-Image Updates (Modifies Files)
+5. **Todo**: "Update base-images to match upstream changes"
+   - For each affected `.devops/base-images/*.Dockerfile`:
+     - Apply upstream changes (versions, CMake flags, etc.)
+     - PRESERVE BodhiApp adaptations:
+       - Version metadata ARGs and labels
+       - Platform-triple folder structure
+       - Non-root user setup
+       - Health checks
+       - No ENTRYPOINT
+     - Use Edit tool for precise changes
+
+6. **Todo**: "Verify syntax and completeness"
+   - Read updated files to confirm changes
+   - Check that BodhiApp patterns remain intact
+
+### Phase 4: Reporting
+7. **Todo**: "Generate comprehensive sync report"
+   - Present structured summary with all findings
+   - Include before/after comparisons
+   - List exact commands to review changes
+   - Recommend testing steps
+
+**Mark each todo as in_progress when working on it, completed when done.**
+
+## Quality Assurance Checklist
+
+Before completing workflow, verify:
+- ✅ All Dockerfile syntax is valid
+- ✅ Base-image versions are available (check Docker Hub/registries)
+- ✅ BodhiApp patterns preserved (metadata, folder structure, labels, health checks)
+- ✅ No ENTRYPOINT in base-images (BodhiApp sets its own)
+- ✅ CMake flags match upstream improvements
+- ✅ No credentials or sensitive data exposed
+- ✅ Dependency versions are compatible
+- ✅ Platform-triple paths are correct (`/app/bin/<platform-triple>/<variant>/`)
+
+## BodhiApp Pattern Reference
+
+### What to ALWAYS Preserve (BodhiApp Adaptations)
+
+```dockerfile
+# 1. Version metadata ARGs (at top of Dockerfile)
+ARG BUILD_VERSION
+ARG BUILD_COMMIT
+ARG BUILD_TIMESTAMP
+ARG BUILD_BRANCH
+
+# 2. Platform-triple folder structure (build stage)
+RUN ARCH=$(uname -m) && \
+    if [ "$ARCH" = "x86_64" ]; then \
+        PLATFORM_TRIPLE="x86_64-unknown-linux-gnu"; \
+    elif [ "$ARCH" = "aarch64" ]; then \
+        PLATFORM_TRIPLE="aarch64-unknown-linux-gnu"; \
+    fi && \
+    mkdir -p /app/bin/$PLATFORM_TRIPLE/<variant> && \
+    cp build/bin/llama-server /app/bin/$PLATFORM_TRIPLE/<variant>/ && \
+    cp /app/lib/*.so /app/bin/$PLATFORM_TRIPLE/<variant>/
+
+# 3. Non-root user setup (server stage)
+RUN groupadd -r llama && useradd -r -g llama -d /app -s /bin/bash llama && \
+    chown -R llama:llama /app
+USER llama
+
+# 4. Comprehensive labels (server stage)
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${BUILD_COMMIT}"
+LABEL bodhi.build.timestamp="${BUILD_TIMESTAMP}"
+LABEL bodhi.build.branch="${BUILD_BRANCH}"
+LABEL bodhi.variant="<variant>"
+
+# 5. Health check (server stage)
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+    CMD test -x /app/bin/<platform-triple>/<variant>/llama-server
+
+# 6. Version file creation (server stage)
+RUN echo "{\"version\":\"${BUILD_VERSION}\",\"commit\":\"${BUILD_COMMIT}\",...}" > /app/version.json
+
+# 7. NO ENTRYPOINT (BodhiApp sets its own)
+# (Upstream might have ENTRYPOINT - we never add it)
+```
+
+### What to UPDATE (Upstream Improvements)
+
+```dockerfile
+# 1. Base image versions (FROM statements)
+FROM nvidia/cuda:12.6.2-devel-ubuntu24.04  # Update versions
+
+# 2. CMake flags and GPU architectures
+-DCUDA_ARCHITECTURES="..."  # Add new architectures
+-DGGML_HIP_ROCWMMA_FATTN=ON  # Add new feature flags
+
+# 3. Runtime dependencies
+RUN apt-get update && apt-get install -y \
+    new-dependency-v2.0  # Update package versions
+
+# 4. Build optimizations
+-DGGML_NATIVE=OFF  # Match upstream build flags
+```
+
+## Communication Style
+
+- **Structured Reports**: Use clear headings and bullet points
+- **Action-Oriented**: Provide exact commands, not just descriptions
+- **Highlight Critical Changes**: Mark Dockerfile changes as CRITICAL
+- **Before/After Comparisons**: Show what changed and why
+- **Explicit Next Steps**: Tell user exactly what to do next
+- **State Assumptions**: When uncertain, clearly state assumptions
+
+## Success Criteria
+
+Your work is complete when:
+1. ✅ All todos marked as completed
+2. ✅ Upstream changes synced (or conflicts documented)
+3. ✅ Base-images updated to match upstream improvements
+4. ✅ BodhiApp patterns preserved intact
+5. ✅ Comprehensive report generated with review commands
+6. ✅ User has clear path to test and commit changes
+
+**Remember**: Make upstream sync effortless while maintaining complete transparency and control. The user should understand every change and feel confident committing them.

.devops/base-images/Makefile

@@ -0,0 +1,136 @@
+.PHONY: help release-base-images show-git-info build-local test-local-images clean-local-images
+
+help: ## Show this help message
+	@echo 'Usage: make [target]'
+	@echo ''
+	@echo 'Base Images Release Targets:'
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z0-9._-]+:.*?## / {printf "  \033[36m%-25s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+# Function to check git branch status - borrowed from BodhiApp
+define check_git_branch
+	@CURRENT_BRANCH=$$(git branch --show-current) && \
+	if [ "$$CURRENT_BRANCH" != "master" ]; then \
+		read -p "Warning: You are not on master branch (current: $$CURRENT_BRANCH). Continue? [y/N] " confirm && \
+		if [ "$$confirm" != "y" ]; then \
+			echo "Aborting release." && exit 1; \
+		fi \
+	fi && \
+	echo "Fetching latest changes from remote..." && \
+	git fetch origin master && \
+	LOCAL_HEAD=$$(git rev-parse HEAD) && \
+	REMOTE_HEAD=$$(git rev-parse origin/master) && \
+	if [ "$$LOCAL_HEAD" != "$$REMOTE_HEAD" ]; then \
+		echo "Warning: Your local master branch is different from origin/master" && \
+		echo "Local:  $$LOCAL_HEAD" && \
+		echo "Remote: $$REMOTE_HEAD" && \
+		read -p "Continue anyway? [y/N] " confirm && \
+		if [ "$$confirm" != "y" ]; then \
+			echo "Aborting release." && exit 1; \
+		fi \
+	fi
+endef
+
+# Function to safely delete existing tag - borrowed from BodhiApp
+define delete_tag_if_exists
+	echo "Checking for existing tag $(1)..." && \
+	if git rev-parse "$(1)" >/dev/null 2>&1; then \
+		read -p "Tag $(1) already exists. Delete and recreate? [y/N] " confirm && \
+		if [ "$$confirm" = "y" ]; then \
+			echo "Deleting existing tag $(1)..." && \
+			git tag -d "$(1)" 2>/dev/null || true && \
+			git push --delete origin "$(1)" 2>/dev/null || true; \
+		else \
+			echo "Aborting release." && exit 1; \
+		fi \
+	fi
+endef
+
+
+# Function to create timestamp-based version from git commit
+define create_version_from_git
+	COMMIT_TIMESTAMP=$$(git log -1 --format=%ct) && \
+	COMMIT_HASH=$$(git rev-parse --short=7 HEAD) && \
+	if [ "$$(uname)" = "Darwin" ]; then \
+		VERSION="$$(date -r $$COMMIT_TIMESTAMP +%y%m%d%H%M)-$$COMMIT_HASH"; \
+	else \
+		VERSION="$$(date -d @$$COMMIT_TIMESTAMP +%y%m%d%H%M)-$$COMMIT_HASH"; \
+	fi && \
+	echo "$$VERSION"
+endef
+
+release-base-images: ## Create and push tag for base images release (timestamp-based versioning)
+	@echo "Preparing to release llama.cpp base images..."
+	$(call check_git_branch)
+	@echo "Creating version from current git commit..."
+	@VERSION=$$($(call create_version_from_git)) && \
+	TAG_NAME="base-images/v$$VERSION" && \
+	echo "New version from git commit: $$VERSION" && \
+	echo "Tag to create: $$TAG_NAME" && \
+	$(call delete_tag_if_exists,$$TAG_NAME) && \
+	echo "Creating base images release tag $$TAG_NAME..." && \
+	git tag "$$TAG_NAME" && \
+	git push origin "$$TAG_NAME" && \
+	echo "Base images release tag $$TAG_NAME pushed. GitHub workflow will handle the Docker image build and publish."
+
+
+show-git-info: ## Show current git commit information for version generation
+	@echo "=== Git Information for Version Generation ==="
+	@COMMIT_TIMESTAMP=$$(git log -1 --format=%ct) && \
+	COMMIT_HASH=$$(git rev-parse --short=7 HEAD) && \
+	if [ "$$(uname)" = "Darwin" ]; then \
+		READABLE_DATE=$$(date -r $$COMMIT_TIMESTAMP "+%Y-%m-%d %H:%M:%S") && \
+		VERSION="$$(date -r $$COMMIT_TIMESTAMP +%y%m%d%H%M)-$$COMMIT_HASH"; \
+	else \
+		READABLE_DATE=$$(date -d @$$COMMIT_TIMESTAMP "+%Y-%m-%d %H:%M:%S") && \
+		VERSION="$$(date -d @$$COMMIT_TIMESTAMP +%y%m%d%H%M)-$$COMMIT_HASH"; \
+	fi && \
+	echo "Current commit: $$COMMIT_HASH" && \
+	echo "Commit timestamp: $$COMMIT_TIMESTAMP" && \
+	echo "Readable date: $$READABLE_DATE" && \
+	echo "Generated version: $$VERSION" && \
+	echo "Tag would be: base-images/v$$VERSION"
+	@echo "============================================="
+
+build-local: ## Build base images locally for testing (requires Docker Buildx)
+	@echo "Building base images locally for testing..."
+	@if ! command -v docker >/dev/null 2>&1; then \
+		echo "Error: Docker is required but not installed"; \
+		exit 1; \
+	fi
+	@if ! docker buildx version >/dev/null 2>&1; then \
+		echo "Error: Docker Buildx is required but not available"; \
+		exit 1; \
+	fi
+	@VERSION=$$($(call create_version_from_git)) && \
+	echo "Building with version: $$VERSION" && \
+	for variant in cpu cuda rocm vulkan musa intel cann; do \
+		echo "Building $$variant variant..." && \
+		docker buildx build \
+			--load \
+			--build-arg BUILD_VERSION="$$VERSION" \
+			--build-arg BUILD_COMMIT="$$(git rev-parse HEAD)" \
+			--build-arg BUILD_TIMESTAMP="$$(git log -1 --format=%ct)" \
+			--build-arg BUILD_BRANCH="$$(git branch --show-current)" \
+			-f "$$variant.Dockerfile" \
+			-t "llama.cpp:$$VERSION-$$variant" \
+			../.. || exit 1; \
+	done && \
+	echo "All variants built successfully with version: $$VERSION"
+
+test-local-images: ## Test locally built images
+	@echo "Testing locally built base images..."
+	@VERSION=$$($(call create_version_from_git)) && \
+	for variant in cpu cuda rocm vulkan musa intel cann; do \
+		echo "Testing $$variant variant..." && \
+		docker run --rm "llama.cpp:$$VERSION-$$variant" --version || echo "Warning: $$variant test failed" && \
+		echo "Testing version metadata for $$variant..." && \
+		docker run --rm "llama.cpp:$$VERSION-$$variant" cat /app/version.json 2>/dev/null || echo "Warning: version.json not found in $$variant"; \
+	done
+
+clean-local-images: ## Clean up locally built images
+	@echo "Cleaning up locally built base images..."
+	@VERSION=$$($(call create_version_from_git)) && \
+	for variant in cpu cuda rocm vulkan musa intel cann; do \
+		docker rmi "llama.cpp:$$VERSION-$$variant" 2>/dev/null || true; \
+	done && \
+	echo "Cleanup complete"