Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/netbox/netbox_test.go

@@ -6,9 +6,13 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 )
 
+// patchedDevice records whether the fake NetBox saw a PATCH on device 12.
+var patchedDevice atomic.Bool
+
 // fakeNetBox serves canned NetBox v4.x JSON for the endpoints bootapi calls.
 // The payloads are trimmed but structurally faithful to real API responses.
 func fakeNetBox(t *testing.T) *httptest.Server {
@@ -38,8 +42,13 @@ func fakeNetBox(t *testing.T) *httptest.Server {
 		}
 	})
 
-	// Device detail.
+	// Device detail (GET) + pxe_enabled write (PATCH).
 	mux.HandleFunc("/api/dcim/devices/", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPatch && strings.HasSuffix(r.URL.Path, "/12/") {
+			patchedDevice.Store(true)
+			writeJSON(w, `{"id":12,"name":"web01"}`)
+			return
+		}
 		if strings.HasSuffix(r.URL.Path, "/12/") {
 			writeJSON(w, `{
 				"id":12,"name":"web01",
@@ -47,7 +56,7 @@ func fakeNetBox(t *testing.T) *httptest.Server {
 				"role":{"id":2,"name":"K8s Worker","slug":"kubernetes-worker"},
 				"site":{"slug":"syd1"},
 				"primary_ip":{"address":"10.0.1.20/24"},
-				"custom_fields":{"domain":"syd1.au.unkin.net","gateway":"10.0.1.254","nameservers":"10.0.0.1,10.0.0.2","provision_template":null}}`)
+				"custom_fields":{"domain":"syd1.au.unkin.net","gateway":"10.0.1.254","nameservers":"10.0.0.1,10.0.0.2","provision_template":null,"pxe_enabled":true}}`)
 			return
 		}
 		// name= query (HostByName)
@@ -102,6 +111,12 @@ func TestHostByMAC(t *testing.T) {
 	if h.PrimaryIP != "10.0.1.20" {
 		t.Errorf("primaryIP = %q", h.PrimaryIP)
 	}
+	if h.DeviceID != 12 {
+		t.Errorf("deviceID = %d, want 12", h.DeviceID)
+	}
+	if h.PXEEnabled == nil || !*h.PXEEnabled || !h.ShouldPXEInstall() {
+		t.Errorf("pxe_enabled = %v, want true", h.PXEEnabled)
+	}
 	if len(h.Nameservers) != 2 || h.Nameservers[0] != "10.0.0.1" {
 		t.Errorf("nameservers = %v", h.Nameservers)
 	}
@@ -181,6 +196,44 @@ func TestAuthTokenRequired(t *testing.T) {
 	}
 }
 
+func TestSetPXEEnabled(t *testing.T) {
+	srv := fakeNetBox(t)
+	defer srv.Close()
+	patchedDevice.Store(false)
+	c := newTestClient(t, srv.URL)
+
+	if err := c.SetPXEEnabled(context.Background(), 12, false); err != nil {
+		t.Fatalf("SetPXEEnabled: %v", err)
+	}
+	if !patchedDevice.Load() {
+		t.Error("expected a PATCH to device 12, got none")
+	}
+}
+
+func TestCfBool(t *testing.T) {
+	tr := true
+	cases := []struct {
+		cf   map[string]any
+		want *bool
+	}{
+		{map[string]any{"pxe_enabled": true}, &tr},
+		{map[string]any{"pxe_enabled": "false"}, boolp(false)},
+		{map[string]any{"pxe_enabled": nil}, nil},
+		{map[string]any{}, nil},
+	}
+	for _, c := range cases {
+		got := cfBool(c.cf, "pxe_enabled")
+		switch {
+		case got == nil && c.want == nil:
+		case got != nil && c.want != nil && *got == *c.want:
+		default:
+			t.Errorf("cfBool(%v) = %v, want %v", c.cf, got, c.want)
+		}
+	}
+}
+
+func boolp(b bool) *bool { return &b }
+
 func TestNormalizeMAC(t *testing.T) {
 	cases := map[string]string{
 		"AA:BB:CC:00:11:22": "aa:bb:cc:00:11:22",