Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

apps/pkg/repo/root.go

@@ -0,0 +1,42 @@
+package repo
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// Root finds the repository root (directory that contains apps/pkg/go.mod
+// and is not itself under apps/ — i.e. the real checkout root).
+func Root() string {
+	wd, err := os.Getwd()
+	if err != nil {
+		wd = "."
+	}
+	cur := wd
+	for i := 0; i < 16; i++ {
+		// Require apps/pkg/go.mod AND a sibling marker so that walking from
+		// inside apps/pkg does not treat apps/ as the root (apps/pkg/go.mod
+		// would match the old top-level pkg/ layout check).
+		pkgMod := filepath.Join(cur, "apps", "pkg", "go.mod")
+		if _, err := os.Stat(pkgMod); err == nil {
+			if markerOK(cur) {
+				return cur
+			}
+		}
+		parent := filepath.Dir(cur)
+		if parent == cur {
+			break
+		}
+		cur = parent
+	}
+	return wd
+}
+
+func markerOK(root string) bool {
+	for _, name := range []string{"build.ps1", "README.md", "configs", "outputs"} {
+		if _, err := os.Stat(filepath.Join(root, name)); err == nil {
+			return true
+		}
+	}
+	return false
+}