Expose gocache over PureLB instead of ClusterIP

A ClusterIP is only reachable via kubectl port-forward, which needs a
create grant on pods/portforward that the read-only operator context does
not have; laptops reach the cache over wireguard.

- Publish the Service as a LoadBalancer on 198.18.200.11 in the common pool
- Set externalTrafficPolicy Local so the client IP survives to the nginx
  allow rules, matching the bind LoadBalancers

apps/base/woodpecker/configmap_gocache-nginx.yaml

@@ -24,6 +24,8 @@ data:
 
         # The protocol has no authentication: anyone who can reach this port can
         # write cache entries, which become code in every build that reads them.
+        # Loopback is the kubectl port-forward fallback; in a pod netns it is
+        # only these two containers.
         allow 127.0.0.1/32;
         allow 10.10.12.200/32;
         allow 10.42.0.0/16;

apps/base/woodpecker/service_gocache.yaml

@@ -4,10 +4,16 @@ kind: Service
 metadata:
   name: gocache
   namespace: woodpecker
+  annotations:
+    purelb.io/addresses: 198.18.200.11
+    purelb.io/service-group: common
   labels:
     app.kubernetes.io/name: gocache
 spec:
-  type: ClusterIP
+  type: LoadBalancer
+  # Cluster SNATs off-node traffic to a node address, which would defeat the
+  # nginx allow rules; Local preserves the wireguard client IP.
+  externalTrafficPolicy: Local
   selector:
     app.kubernetes.io/name: gocache
   ports: