Seed bootapi-images: AlmaLinux node rootfs build

Builds the AlmaLinux 9 node rootfs tarball bootapi's image-based provisioning
(liveimg) unpacks, and on a v* tag publishes almalinux9-node-<ver>.tar.zst to the
artifactapi rootfs-images repo. Moved out of bootapi-templates (which stays
templates-only) per review on bootapi-templates#3.

- packages.txt (bake list) + scripts/build-rootfs.sh (dnf --installroot -> tar.zst).
- .woodpecker: pre-commit + shellcheck (PR); build+upload on v* tag.
- Makefile (build/lint/patch|minor|major).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

scripts/build-rootfs.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# Build the AlmaLinux 9 node rootfs and tar it as almalinux9-node-<ver>.tar.zst
+# for bootapi image-based provisioning (liveimg). Usage:
+#   scripts/build-rootfs.sh [version]   (version defaults to ${CI_COMMIT_TAG#v})
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+VER="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
+VER="${VER#v}"
+RELEASEVER="${RELEASEVER:-9}"
+ROOTFS="${ROOTFS:-${ROOT_DIR}/rootfs}"
+DIST="${DIST:-${ROOT_DIR}/dist}"
+OUT="${DIST}/almalinux9-node-${VER}.tar.zst"
+
+# Read the bake list (skip comments / blank lines).
+mapfile -t PKGS < <(grep -vE '^[[:space:]]*(#|$)' packages.txt)
+if [ "${#PKGS[@]}" -eq 0 ]; then
+  echo "ERROR: packages.txt is empty" >&2
+  exit 1
+fi
+
+rm -rf "${ROOTFS}"
+mkdir -p "${ROOTFS}" "${DIST}"
+
+dnf -y --installroot="${ROOTFS}" --releasever="${RELEASEVER}" \
+  --setopt=install_weak_deps=False install "${PKGS[@]}"
+
+# Puppet agent from the puppet platform repo (baked; image.ks.tmpl %post only
+# configures it).
+dnf -y --installroot="${ROOTFS}" install https://yum.puppet.com/puppet8-release-el-9.noarch.rpm
+dnf -y --installroot="${ROOTFS}" install puppet-agent
+
+dnf -y --installroot="${ROOTFS}" clean all
+rm -rf "${ROOTFS}"/var/cache/dnf/* "${ROOTFS}"/var/log/dnf* "${ROOTFS}"/etc/machine-id
+
+# Reproducible, ownership/xattr/SELinux-preserving tarball.
+tar --numeric-owner --acls --xattrs --selinux -C "${ROOTFS}" -caf "${OUT}" .
+
+echo "Built: ${OUT}"
+ls -lh "${OUT}"