Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/netbox/netbox.go

@@ -5,6 +5,7 @@
 package netbox
 
 import (
+	"bytes"
 	"context"
 	"crypto/tls"
 	"encoding/json"
@@ -29,6 +30,19 @@ type Resolver interface {
 	HostByName(ctx context.Context, name string) (*model.Host, error)
 }
 
+// Writer mutates NetBox. Today it only flips the pxe_enabled gate (the
+// end-of-kickstart callback). Kept separate from Resolver so read-only callers
+// need not depend on write scope.
+type Writer interface {
+	SetPXEEnabled(ctx context.Context, deviceID int, enabled bool) error
+}
+
+// API is the full NetBox surface bootapi uses (reads + the pxe_enabled write).
+type API interface {
+	Resolver
+	Writer
+}
+
 // Client is the HTTP-backed Resolver.
 type Client struct {
 	baseURL string
@@ -199,11 +213,13 @@ func buildHost(dev *nbDevice, ifaces []nbInterface, ips []nbIPAddress) *model.Ho
 	domain := cfString(cf, "domain")
 
 	h := &model.Host{
+		DeviceID:         dev.ID,
 		Hostname:         dev.Name,
 		Domain:           domain,
 		Custom:           cf,
 		Nameservers:      cfStringList(cf, "nameservers"),
 		TemplateOverride: cfString(cf, "provision_template"),
+		PXEEnabled:       cfBool(cf, "pxe_enabled"),
 		Arch:             "x86_64",
 	}
 	if dev.Platform != nil {
@@ -278,6 +294,39 @@ func sortPrimaryFirst(ifaces []model.Interface) {
 	}
 }
 
+// SetPXEEnabled PATCHes the device's pxe_enabled custom field. This is the only
+// write bootapi performs; the NetBox token therefore needs write scope on the
+// device custom field (see docs/security.md).
+func (c *Client) SetPXEEnabled(ctx context.Context, deviceID int, enabled bool) error {
+	body := map[string]any{"custom_fields": map[string]any{"pxe_enabled": enabled}}
+	b, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	path := fmt.Sprintf("/api/dcim/devices/%d/", deviceID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPatch, c.baseURL+path, bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+	if c.token != "" {
+		req.Header.Set("Authorization", "Token "+c.token)
+	}
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("netbox patch device %d: %w", deviceID, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode == http.StatusNotFound {
+		return ErrNotFound
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("netbox patch device %d: HTTP %d", deviceID, resp.StatusCode)
+	}
+	return nil
+}
+
 // get performs a GET against the NetBox API and decodes the JSON body into out.
 func (c *Client) get(ctx context.Context, path string, q url.Values, out any) error {
 	u := c.baseURL + path
@@ -393,6 +442,28 @@ func cfString(cf map[string]any, key string) string {
 	return ""
 }
 
+// cfBool reads a boolean custom field. Returns nil when the field is absent or
+// null so callers can distinguish "unset" from "false".
+func cfBool(cf map[string]any, key string) *bool {
+	if cf == nil {
+		return nil
+	}
+	switch v := cf[key].(type) {
+	case bool:
+		return &v
+	case string: // tolerate "true"/"false" string encodings
+		switch strings.ToLower(v) {
+		case "true", "1", "yes":
+			b := true
+			return &b
+		case "false", "0", "no":
+			b := false
+			return &b
+		}
+	}
+	return nil
+}
+
 func cfStringList(cf map[string]any, key string) []string {
 	if cf == nil {
 		return nil