Seed bootapi templates + distro catalog

Initial content for bootapi's git-synced template set: the kickstart and iPXE
templates and the distro catalog (almalinux9, fedora) ported from bootapi's
embedded defaults, plus CI that validates every template/catalog renders for
every distro (bootapi validate) and shellchecks the %post blocks.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

ci/shellcheck-post.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+#
+# Best-effort shellcheck of the %post ... %end blocks in the kickstart templates.
+# The bodies are Go text/templates, so we first replace every {{ ... }} action
+# with a shell-safe placeholder, then extract each %post block into a script and
+# run shellcheck at "error" severity (template placeholders make lower-severity
+# style warnings meaningless). Fails the build on any shellcheck error.
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+tmp="$(mktemp -d)"
+trap 'rm -rf "${tmp}"' EXIT
+rc=0
+
+shopt -s nullglob
+for ks in kickstart/*.ks.tmpl; do
+  # Split into %post-scriptlets; strip {{...}} -> "PH"; give each a shebang.
+  awk '
+    /^%post/ { inpost=1; n++; next }
+    /^%end/  { inpost=0; next }
+    inpost   { print > ("'"${tmp}"'/post-" n ".sh") }
+  ' "${ks}"
+
+  for f in "${tmp}"/post-*.sh; do
+    [ -e "${f}" ] || continue
+    # Neutralize Go template actions and prepend a shebang.
+    sed -i 's/{{[^}]*}}/PH/g' "${f}"
+    printf '#!/usr/bin/env bash\n%s' "$(cat "${f}")" > "${f}.final"
+    echo "shellcheck (error severity): ${ks} -> $(basename "${f}")"
+    if ! shellcheck -S error "${f}.final"; then
+      rc=1
+    fi
+    rm -f "${f}" "${f}.final"
+  done
+done
+
+if [ "${rc}" -eq 0 ]; then
+  echo "shellcheck: no errors in %post blocks"
+fi
+exit "${rc}"