Seed bootapi templates + distro catalog

Initial content for bootapi's git-synced template set: the kickstart and iPXE
templates and the distro catalog (almalinux9, fedora) ported from bootapi's
embedded defaults, plus CI that validates every template/catalog renders for
every distro (bootapi validate) and shellchecks the %post blocks.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

ipxe/boot.ipxe.tmpl

@@ -0,0 +1,20 @@
+{{- /*
+iPXE boot script for a known, PXE-enabled host. Chains the OS installer
+kernel+initrd (from the distro catalog) and points inst.ks= back at bootapi's
+/ks/<host> over plain HTTP, so an installer with no internal-CA trust can fetch
+it. Mirrors how Cobbler generated a per-MAC gPXE script carrying inst.ks=.
+
+KernelURL/InitrdURL/RepoURL come from the selected catalog entry (artifactapi
+remote); KernelArgs are the catalog's extra args. KickstartURL uses
+BOOTAPI_BASE_URL (http://).
+*/ -}}
+#!ipxe
+echo bootapi: provisioning {{ .FQDN }} ({{ .Platform }})
+{{ if and .KernelURL .InitrdURL -}}
+kernel {{ .KernelURL }} initrd=initrd.img{{ if .RepoURL }} inst.repo={{ .RepoURL }}{{ end }} inst.ks={{ .KickstartURL }} ip=dhcp{{ range .KernelArgs }} {{ . }}{{ end }}
+initrd {{ .InitrdURL }}
+boot
+{{- else -}}
+echo bootapi: no boot images resolved for {{ .Platform }} (no catalog entry / BOOTAPI_BOOT_BASE_URL); booting local disk
+sanboot --no-describe --drive 0x80 || exit
+{{- end }}

ipxe/fallback-local.ipxe.tmpl

@@ -0,0 +1,10 @@
+{{- /*
+Safe default for an UNKNOWN MAC (NetBox has no matching device). We deliberately
+do NOT start an installer for a machine we can't identify — that could wipe a
+production box that PXE-booted by accident. Instead we boot from local disk, so
+an already-installed host just continues, and a brand-new host loops back to PXE
+on its next attempt (by which point NetBox should know it).
+*/ -}}
+#!ipxe
+echo bootapi: unknown MAC ${net0/mac}; not provisioning. Booting local disk.
+sanboot --no-describe --drive 0x80 || exit

ipxe/fallback-shell.ipxe.tmpl

@@ -0,0 +1,10 @@
+{{- /*
+Debug fallback for an unknown MAC (opt in via BOOTAPI_UNKNOWN_MAC_FALLBACK=shell).
+Drops to an interactive iPXE shell instead of booting anything, so an operator
+racking a new box can inspect ${net0/mac} and register it in NetBox. Not the
+default because it halts the boot and is unsafe for an accidental PXE of a prod
+host.
+*/ -}}
+#!ipxe
+echo bootapi: unknown MAC ${net0/mac}; dropping to iPXE shell for debugging.
+shell