Seed bootapi templates + distro catalog

Initial content for bootapi's git-synced template set: the kickstart and iPXE
templates and the distro catalog (almalinux9, fedora) ported from bootapi's
embedded defaults, plus CI that validates every template/catalog renders for
every distro (bootapi validate) and shellchecks the %post blocks.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

README.md

@@ -1,3 +1,43 @@
 # bootapi-templates
 
-Live kickstart/iPXE templates + distro catalog for bootapi. Pulled by bootapi via git-sync; CI validates templates render for every distro.
+Live kickstart / iPXE templates and the **distro catalog** for
+[bootapi](https://git.unkin.net/unkin/bootapi). bootapi git-syncs this repo
+(every ~3 minutes, like argocd) and hot-swaps its template set on change, so OS
+and template updates ship by merging here — no bootapi rebuild or redeploy. If
+this repo is unreachable, bootapi falls back to its embedded copy of these files.
+
+## Layout
+
+```
+kickstart/<name>.ks.tmpl     # kickstart templates (Go text/template)
+ipxe/<name>.ipxe.tmpl        # iPXE scripts: boot, fallback-local, fallback-shell
+catalog/<name>.yaml          # distro catalog: host -> boot images + kickstart
+catalog/README.md            # catalog field reference + debian/talos path
+ci/shellcheck-post.sh        # %post shellcheck helper (used by CI)
+```
+
+The data model available to templates and the catalog field reference live in
+the bootapi docs: [data-model](https://git.unkin.net/unkin/bootapi/src/branch/main/docs/data-model.md),
+[template-authoring](https://git.unkin.net/unkin/bootapi/src/branch/main/docs/template-authoring.md),
+and [catalog/README.md](catalog/README.md) here.
+
+## CI (required before merge)
+
+- **validate** — `bootapi validate .` renders every kickstart + iPXE script for
+  every catalog distro against a fixture host and fails on any parse/resolve
+  error or unresolved `<no value>`. Plus `shellcheck` (error severity) of the
+  `%post` blocks.
+- **pre-commit** — yamllint + whitespace/EOF checks.
+
+Validate locally before pushing:
+
+```bash
+go run git.unkin.net/unkin/bootapi/cmd/bootapi@main validate .
+bash ci/shellcheck-post.sh   # needs shellcheck
+```
+
+## Adding a distro
+
+Add `catalog/<name>.yaml` + `kickstart/<name>.ks.tmpl` (and, if the OS needs a
+mirror bootapi can't reach, a terraform-artifactapi remote). See
+[catalog/README.md](catalog/README.md) — including the debian/talos path.