Seed bootapi templates + distro catalog

Initial content for bootapi's git-synced template set: the kickstart and iPXE
templates and the distro catalog (almalinux9, fedora) ported from bootapi's
embedded defaults, plus CI that validates every template/catalog renders for
every distro (bootapi validate) and shellchecks the %post blocks.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

ipxe/fallback-shell.ipxe.tmpl

@@ -0,0 +1,10 @@
+{{- /*
+Debug fallback for an unknown MAC (opt in via BOOTAPI_UNKNOWN_MAC_FALLBACK=shell).
+Drops to an interactive iPXE shell instead of booting anything, so an operator
+racking a new box can inspect ${net0/mac} and register it in NetBox. Not the
+default because it halts the boot and is unsafe for an accidental PXE of a prod
+host.
+*/ -}}
+#!ipxe
+echo bootapi: unknown MAC ${net0/mac}; dropping to iPXE shell for debugging.
+shell