Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/netbox/cache_test.go

@@ -12,10 +12,11 @@ import (
 
 // countingResolver records how many times the underlying resolver is hit.
 type countingResolver struct {
-	mu    sync.Mutex
-	calls int
-	host  *model.Host
-	err   error
+	mu     sync.Mutex
+	calls  int
+	writes int
+	host   *model.Host
+	err    error
 }
 
 func (c *countingResolver) HostByMAC(context.Context, string) (*model.Host, error) {
@@ -27,6 +28,12 @@ func (c *countingResolver) HostByMAC(context.Context, string) (*model.Host, erro
 func (c *countingResolver) HostByName(context.Context, string) (*model.Host, error) {
 	return c.HostByMAC(context.Background(), "")
 }
+func (c *countingResolver) SetPXEEnabled(context.Context, int, bool) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.writes++
+	return c.err
+}
 
 func TestCacheHitAndExpiry(t *testing.T) {
 	inner := &countingResolver{host: &model.Host{Hostname: "web01"}}
@@ -60,6 +67,29 @@ func TestCacheHitAndExpiry(t *testing.T) {
 	}
 }
 
+func TestCacheInvalidatedOnWrite(t *testing.T) {
+	inner := &countingResolver{host: &model.Host{Hostname: "web01"}}
+	cache := NewCache(inner, time.Minute)
+
+	// Warm the cache.
+	if _, err := cache.HostByMAC(context.Background(), "aa:bb:cc:00:11:22"); err != nil {
+		t.Fatal(err)
+	}
+	// A write must drop the cache so the next read re-resolves.
+	if err := cache.SetPXEEnabled(context.Background(), 12, false); err != nil {
+		t.Fatal(err)
+	}
+	if inner.writes != 1 {
+		t.Fatalf("inner writes = %d, want 1", inner.writes)
+	}
+	if _, err := cache.HostByMAC(context.Background(), "aa:bb:cc:00:11:22"); err != nil {
+		t.Fatal(err)
+	}
+	if inner.calls != 2 {
+		t.Fatalf("inner calls = %d, want 2 (cache dropped by write)", inner.calls)
+	}
+}
+
 func TestCacheDisabled(t *testing.T) {
 	inner := &countingResolver{host: &model.Host{Hostname: "web01"}}
 	cache := NewCache(inner, 0) // ttl <= 0 disables caching