Seed bootapi-images: AlmaLinux node rootfs build

Builds the AlmaLinux 9 node rootfs tarball bootapi's image-based provisioning
(liveimg) unpacks, and on a v* tag publishes almalinux9-node-<ver>.tar.zst to the
artifactapi rootfs-images repo. Moved out of bootapi-templates (which stays
templates-only) per review on bootapi-templates#3.

- packages.txt (bake list) + scripts/build-rootfs.sh (dnf --installroot -> tar.zst).
- .woodpecker: pre-commit + shellcheck (PR); build+upload on v* tag.
- Makefile (build/lint/patch|minor|major).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

.woodpecker/pre-commit.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: [pull_request, push]
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2