Address PR review: PXE gate + callback, git-sync templates, distro catalog, k8s targets, http+https

Implements the six review comments on PR #1:

- Per-host PXE-enable gate: read NetBox pxe_enabled custom field; a known host
  with it false gets the safe local-boot script (Cobbler netboot_enabled). Add a
  token-guarded POST /provisioned/{ident} callback that clears pxe_enabled in
  NetBox, plus a %post snippet in the default kickstarts that calls it.
- Templates from a git repo: bootapi clones a templates repo and re-pulls every
  BOOTAPI_TEMPLATE_GIT_INTERVAL (default 3m), atomically swapping the template
  set (last-good kept on parse failure; embedded defaults are the startup
  fallback). Metrics for syncs/failures/generation.
- Distro catalog (catalog/*.yaml): NetBox host -> boot images/kickstart, so
  adding an OS is a YAML + template change. Ships almalinux + fedora entries
  (artifactapi remotes); debian/talos path documented.
- Boot images from the artifactapi almalinux/fedora remotes via the catalog.
- Bind resolvers, puppet server/CA and PUPPETCA_URL env file now target the k8s
  services (198.18.200.7; puppet(ca).k8s.syd1.au.unkin.net).
- Boot path served over plain HTTP (installers lack CA trust) with an optional
  parallel HTTPS listener; docs say do not 301 the boot endpoints.

New packages: internal/catalog, internal/gitsync. NetBox client gains a
pxe_enabled write (token needs that scope - noted in docs). `bootapi validate`
subcommand validates a template/catalog set for the templates-repo CI.

go build/vet clean, go test -race green, golangci-lint v2 clean, pre-commit clean.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

templates/ipxe/boot.ipxe.tmpl

@@ -1,20 +1,20 @@
 {{- /*
-iPXE boot script for a known host. Chains the OS installer kernel+initrd and
-points inst.ks= back at bootapi's /ks/<hostname> endpoint, mirroring how Cobbler
-generated a per-MAC gPXE script that carried inst.ks=.
+iPXE boot script for a known, PXE-enabled host. Chains the OS installer
+kernel+initrd (from the distro catalog) and points inst.ks= back at bootapi's
+/ks/<host> over plain HTTP, so an installer with no internal-CA trust can fetch
+it. Mirrors how Cobbler generated a per-MAC gPXE script carrying inst.ks=.
 
-Requires BOOTAPI_BOOT_BASE_URL (KernelURL/InitrdURL) and BOOTAPI_BASE_URL
-(KickstartURL) to be configured.
+KernelURL/InitrdURL/RepoURL come from the selected catalog entry (artifactapi
+remote); KernelArgs are the catalog's extra args. KickstartURL uses
+BOOTAPI_BASE_URL (http://).
 */ -}}
 #!ipxe
 echo bootapi: provisioning {{ .FQDN }} ({{ .Platform }})
 {{ if and .KernelURL .InitrdURL -}}
-kernel {{ .KernelURL }} initrd=initrd.img inst.repo={{ .BootBaseURL }} inst.ks={{ .KickstartURL }} inst.text ip=dhcp net.ifnames=0
+kernel {{ .KernelURL }} initrd=initrd.img{{ if .RepoURL }} inst.repo={{ .RepoURL }}{{ end }} inst.ks={{ .KickstartURL }} ip=dhcp{{ range .KernelArgs }} {{ . }}{{ end }}
 initrd {{ .InitrdURL }}
 boot
 {{- else -}}
-echo bootapi: BOOTAPI_BOOT_BASE_URL not configured; cannot build a boot line
-echo Falling back to local disk in 5s
-sleep 5
-exit
+echo bootapi: no boot images resolved for {{ .Platform }} (no catalog entry / BOOTAPI_BOOT_BASE_URL); booting local disk
+sanboot --no-describe --drive 0x80 || exit
 {{- end }}