chore: capture Jenkins Docker baseline

controller/Dockerfile

@@ -0,0 +1,7 @@
+FROM jenkins/jenkins:lts-jdk17
+
+COPY controller/plugins.txt /usr/share/jenkins/ref/plugins.txt
+RUN jenkins-plugin-cli --plugin-file /usr/share/jenkins/ref/plugins.txt
+
+ENV JAVA_OPTS="-Djenkins.install.runSetupWizard=false"
+ENV CASC_JENKINS_CONFIG="/var/jenkins_home/casc_configs/jenkins.yaml"

controller/casc/jenkins.yaml

@@ -0,0 +1,73 @@
+jenkins:
+  systemMessage: "Firmware build Jenkins controller - configured via JCasC"
+  # Controller stays a pure orchestrator; real builds run on the labeled
+  # toolchain agents below. Bump this if you want the controller itself
+  # to run lightweight jobs (e.g. git checkout/fan-out stages).
+  numExecutors: 0
+  securityRealm:
+    local:
+      allowsSignup: false
+      users:
+        - id: "${JENKINS_ADMIN_ID}"
+          password: "${JENKINS_ADMIN_PASSWORD}"
+  authorizationStrategy:
+    loggedInUsersCanDoAnything:
+      allowAnonymousRead: false
+  nodes:
+    - permanent:
+        name: "mcuxpresso-agent"
+        remoteFS: "/home/jenkins"
+        labelString: "mcuxpresso arm-gcc"
+        numExecutors: 2
+        mode: EXCLUSIVE
+        launcher:
+          ssh:
+            host: "mcuxpresso-agent"
+            port: 22
+            credentialsId: "agent-ssh-key"
+            launchTimeoutSeconds: 60
+            maxNumRetries: 5
+            retryWaitTime: 15
+            sshHostKeyVerificationStrategy:
+              nonVerifyingKeyVerificationStrategy: {}
+    - permanent:
+        name: "mplabx-agent"
+        remoteFS: "/home/jenkins"
+        labelString: "mplabx"
+        numExecutors: 2
+        mode: EXCLUSIVE
+        launcher:
+          ssh:
+            host: "mplabx-agent"
+            port: 22
+            credentialsId: "agent-ssh-key"
+            launchTimeoutSeconds: 60
+            maxNumRetries: 5
+            retryWaitTime: 15
+            sshHostKeyVerificationStrategy:
+              nonVerifyingKeyVerificationStrategy: {}
+
+credentials:
+  system:
+    domainCredentials:
+      - credentials:
+          - basicSSHUserPrivateKey:
+              scope: GLOBAL
+              id: "agent-ssh-key"
+              username: "jenkins"
+              privateKeySource:
+                directEntry:
+                  privateKey: "${AGENT_SSH_PRIVATE_KEY}"
+
+          - basicSSHUserPrivateKey:
+              scope: GLOBAL
+              id: "gitea-ultra2-app"
+              description: "Read-only deploy key for mate/ultra2-app"
+              username: "git"
+              privateKeySource:
+                directEntry:
+                  privateKey: "${GITEA_ULTRA2_APP_PRIVATE_KEY}"
+
+unclassified:
+  location:
+    url: "https://jenkins.sparksoftdesign.com/"

controller/plugins.txt

@@ -0,0 +1,5 @@
+configuration-as-code
+ssh-slaves
+git
+workflow-aggregator
+credentials-binding