Add reproducible build infrastructure

Pin Rust toolchain to 1.94.0 via rust-toolchain.toml for deterministic
compiler output across environments. Set SOURCE_DATE_EPOCH from git
commit timestamp in CI workflows and packaging scripts to normalize
embedded timestamps.

Make packaging archives reproducible: pass --mtime=@$SOURCE_DATE_EPOCH
to tar in .deb, .ipk, and systemd tarball builds. Normalize ownership
to root:root in systemd tarballs. Pin cargo-zigbuild to 0.19.8 for
cross-compilation stability.

Add SHA-256 hash output to CI build and OpenWrt packaging workflows
for binary verification.

.github/workflows/package-openwrt.yml

@@ -11,6 +11,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  SOURCE_DATE_EPOCH: 0  # overridden per-step after checkout
 
 jobs:
   build:
@@ -46,6 +47,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set SOURCE_DATE_EPOCH from git
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
+
       - name: Derive package version
         id: version
         run: |
@@ -84,7 +88,7 @@ jobs:
             openwrt-${{ matrix.rust_target }}-
 
       - name: Install cargo-zigbuild
-        run: cargo install cargo-zigbuild --locked
+        run: cargo install cargo-zigbuild --version 0.19.8 --locked
 
       - name: Install zig (required by cargo-zigbuild)
         uses: goto-bus-stop/setup-zig@v2
@@ -98,6 +102,13 @@ jobs:
           LLVM_STRIP: llvm-strip
         run: ./packaging/openwrt-ipk/build-ipk.sh --arch ${{ matrix.build_arch }}
 
+      - name: SHA-256 hashes
+        run: |
+          echo "==> Binaries:"
+          sha256sum target/${{ matrix.rust_target }}/release/fips target/${{ matrix.rust_target }}/release/fipsctl target/${{ matrix.rust_target }}/release/fipstop
+          echo "==> Package:"
+          sha256sum dist/${{ steps.version.outputs.filename }}
+
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with: