Add image-based provisioning (liveimg) + shared storage partial

Adds a fast, reproducible install path that unpacks a prebuilt AlmaLinux 9 node
rootfs onto the disk instead of resolving packages, with per-host networking
still templated after the unpack. Storage reuses the OptiPlex model vars so
image and package installs lay disks out identically.

- kickstart/image.ks.tmpl: liveimg --url={{ .DistroVars.rootfs_tarball }};
  %post renders per-host NetworkManager keyfiles from NetBox interface data
  (the image is generic and liveimg clobbers /etc), sets hostname, the
  puppet-initial PUPPETCA_URL env, and the provisioned callback.
- kickstart/_storage.ks.tmpl: shared storage-block/storage-pre partials
  (storage_mode / vg_grow); almalinux9.ks.tmpl now uses them too (no behaviour
  change) so both installs share one storage layout.
- catalog/almalinux9-image.yaml (generic autopart) + optiplex-7080-image.yaml
  (auto-nvme + vg_grow) point liveimg at the artifactapi rootfs-images repo.
- .woodpecker/build-image.yaml: builds the rootfs via dnf --installroot,
  tars almalinux9-node-<ver>.tar.zst, uploads to the rootfs-images local repo
  on tag node-image-<ver>.

Validated with bootapi validate + shellcheck; no bootapi code change (DistroVars
+ existing interface data suffice).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

catalog/README.md

@@ -61,6 +61,37 @@ real NetBox platform slug — so these entries are *only* reachable via the
 override and never hijack a plain `almalinux9` host. To add another model, copy
 one of these files, change the `name`/slug and `storage_mode`.
 
+## Image (liveimg) installs
+
+`image.ks.tmpl` unpacks a prebuilt rootfs tarball with Anaconda `liveimg` instead
+of resolving packages — faster and reproducible. An image catalog entry looks
+like a normal one but sets `kickstart: image` and a `rootfs_tarball` var:
+
+```yaml
+name: almalinux9-image
+match: {platforms: [almalinux9-image]}
+kickstart: image
+kernel_url: "{{.ArtifactBase}}/almalinux/{{.Version}}/BaseOS/{{.Arch}}/os/images/pxeboot/vmlinuz"  # the Anaconda installer kernel, unchanged
+initrd_url: "...initrd.img"
+vars:
+  rootfs_tarball: "https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/rootfs-images/files/almalinux9-node-<ver>.tar.zst"
+  # storage_mode / vg_grow work exactly as for package installs (omit for VM autopart).
+```
+
+- **Boot** is still the AlmaLinux installer kernel/initrd; `liveimg` only changes
+  the payload. **Storage** reuses the shared `kickstart/_storage.ks.tmpl` partials
+  (`storage_mode` / `vg_grow`), so image and package installs lay disks out
+  identically — including the OptiPlex NVMe modes (`optiplex-7080-image` shows an
+  image + `auto-nvme` + `vg_grow` combination).
+- **Networking is templated per-host in `%post`** (NetworkManager keyfiles from
+  the same NetBox interface data), because the generic image has no per-host
+  identity and the `liveimg` unpack overwrites `/etc`.
+- The tarball is built by `.woodpecker/build-image.yaml` (tag `node-image-<ver>`)
+  and uploaded to the artifactapi `rootfs-images` local repo. Baked into the
+  image = everything the `%post` assumes present (kernel/grub/dracut,
+  NetworkManager, openssh, chrony, kexec-tools, curl, puppet-agent). Bump an
+  image = new tag + one-line `rootfs_tarball` edit here.
+
 ## Adding another distro (the intended path)
 
 Add `catalog/<name>.yaml` + `kickstart/<name>.ks.tmpl`. If the OS lives on a

catalog/almalinux9-image.yaml

@@ -0,0 +1,22 @@
+# Distro catalog entry: AlmaLinux 9, IMAGE install (liveimg).
+#
+# Boots the same AlmaLinux installer kernel/initrd as almalinux9, but the
+# kickstart (image.ks.tmpl) uses liveimg to unpack the prebuilt node rootfs
+# tarball instead of resolving packages -- much faster, reproducible. Generic
+# storage (autopart on sda). Select via a device's provision_template custom
+# field = "almalinux9-image".
+name: almalinux9-image
+match:
+  platforms: [almalinux9-image]
+kickstart: image
+version_default: "9"
+kernel_url: "{{.ArtifactBase}}/almalinux/{{.Version}}/BaseOS/{{.Arch}}/os/images/pxeboot/vmlinuz"
+initrd_url: "{{.ArtifactBase}}/almalinux/{{.Version}}/BaseOS/{{.Arch}}/os/images/pxeboot/initrd.img"
+kernel_args:
+  - inst.text
+  - net.ifnames=0
+vars:
+  # Prebuilt node rootfs on the artifactapi rootfs-images local repo, built by
+  # .woodpecker/build-image.yaml. Immutable, date-versioned; bump this one line
+  # to roll the fleet forward (overwrites are 409-rejected).
+  rootfs_tarball: "https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/rootfs-images/files/almalinux9-node-20260729.tar.zst"

catalog/optiplex-7080-image.yaml

@@ -0,0 +1,21 @@
+# Distro catalog entry: OptiPlex 7080, IMAGE install (liveimg).
+#
+# The image counterpart of optiplex-7080: same liveimg payload as
+# almalinux9-image, but with the 7080's auto-NVMe / grow-to-fill storage
+# (storage_mode auto-nvme + vg_grow). Proves the image kickstart reuses the
+# OptiPlex model storage exactly as the package install does. Select via a
+# device's provision_template custom field = "optiplex-7080-image".
+name: optiplex-7080-image
+match:
+  platforms: [optiplex-7080-image]
+kickstart: image
+version_default: "9"
+kernel_url: "{{.ArtifactBase}}/almalinux/{{.Version}}/BaseOS/{{.Arch}}/os/images/pxeboot/vmlinuz"
+initrd_url: "{{.ArtifactBase}}/almalinux/{{.Version}}/BaseOS/{{.Arch}}/os/images/pxeboot/initrd.img"
+kernel_args:
+  - inst.text
+  - net.ifnames=0
+vars:
+  rootfs_tarball: "https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/rootfs-images/files/almalinux9-node-20260729.tar.zst"
+  storage_mode: auto-nvme
+  vg_grow: "true"