Seed bootapi-images: AlmaLinux node rootfs build

Builds the AlmaLinux 9 node rootfs tarball bootapi's image-based provisioning
(liveimg) unpacks, and on a v* tag publishes almalinux9-node-<ver>.tar.zst to the
artifactapi rootfs-images repo. Moved out of bootapi-templates (which stays
templates-only) per review on bootapi-templates#3.

- packages.txt (bake list) + scripts/build-rootfs.sh (dnf --installroot -> tar.zst).
- .woodpecker: pre-commit + shellcheck (PR); build+upload on v* tag.
- Makefile (build/lint/patch|minor|major).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

README.md

@@ -1,3 +1,41 @@
 # bootapi-images
 
-Builds AlmaLinux node rootfs tarballs for bootapi image-based provisioning; on v* tag publishes almalinux9-node-<ver>.tar.zst to the artifactapi rootfs-images repo.
+Builds the AlmaLinux 9 **node rootfs** tarball that
+[bootapi](https://git.unkin.net/unkin/bootapi)'s image-based provisioning unpacks
+with Anaconda `liveimg`. On a `v*` tag it publishes
+`almalinux9-node-<ver>.tar.zst` to the artifactapi `rootfs-images` local repo,
+where the [bootapi-templates](https://git.unkin.net/unkin/bootapi-templates)
+`almalinux9-image` catalog entry's `rootfs_tarball` points.
+
+This is the build half; the kickstart/catalog that *consumes* the tarball live in
+bootapi-templates. Kept separate so that repo stays templates-only.
+
+## What's baked in
+
+`packages.txt` is the package set installed into the rootfs — everything the
+`image.ks.tmpl` `%post` assumes is already present (kernel, grub2 BIOS+UEFI,
+dracut, NetworkManager, openssh, chrony, kexec-tools, curl, …). `puppet-agent` is
+added from the puppet platform repo in `scripts/build-rootfs.sh`. Per-host config
+(networking, hostname, puppet server, callback) stays in the kickstart `%post`.
+
+## Layout
+
+```
+packages.txt            # bake list (one package per line)
+scripts/build-rootfs.sh # dnf --installroot -> tar.zst
+.woodpecker/            # pre-commit + lint (PR); release build+upload (v* tag)
+Makefile                # build / lint / patch|minor|major
+```
+
+## Releasing an image
+
+`make patch|minor|major` tags `v<x.y.z>` and pushes; CI builds the rootfs and
+uploads `almalinux9-node-<x.y.z>.tar.zst`. Then bump `rootfs_tarball` in the
+bootapi-templates `almalinux9-image` catalog entry to the new version (immutable;
+overwrites are 409-rejected).
+
+Build locally (needs `dnf`, `tar`, `zstd`, root):
+
+```bash
+make build VERSION=v0.0.0-dev
+```