Seed bootapi templates + distro catalog

Initial content for bootapi's git-synced template set: the kickstart and iPXE
templates and the distro catalog (almalinux9, fedora) ported from bootapi's
embedded defaults, plus CI that validates every template/catalog renders for
every distro (bootapi validate) and shellchecks the %post blocks.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

ipxe/fallback-local.ipxe.tmpl

@@ -0,0 +1,10 @@
+{{- /*
+Safe default for an UNKNOWN MAC (NetBox has no matching device). We deliberately
+do NOT start an installer for a machine we can't identify — that could wipe a
+production box that PXE-booted by accident. Instead we boot from local disk, so
+an already-installed host just continues, and a brand-new host loops back to PXE
+on its next attempt (by which point NetBox should know it).
+*/ -}}
+#!ipxe
+echo bootapi: unknown MAC ${net0/mac}; not provisioning. Booting local disk.
+sanboot --no-describe --drive 0x80 || exit