Fetch templates over HTTP instead of shelling out to git

The runtime image is distroless and has no git binary, so every sync
failed and bootapi silently served the stale embedded templates.

- fetch the branch tarball (<repo>/archive/<branch>.tar.gz) and extract
  it into an in-memory FS; no checkout, no writable volume
- digest the extracted tree, not the archive bytes, so a recompressed
  identical archive is not a change
- skip entries that would escape the tree
- log the source commit from Gitea's immutable Link header

README.md

@@ -88,7 +88,7 @@ internal/model/      Host/Interface data model (incl. pxe_enabled gate)
 internal/netbox/     NetBox client (reads + pxe_enabled write) + TTL cache, behind an interface
 internal/catalog/    distro catalog: NetBox host -> boot images/kickstart
 internal/render/     text/template engine (swappable Set), selection, loader
-internal/gitsync/    periodic git pull + atomic template reload (last-good)
+internal/gitsync/    periodic templates-tarball fetch + atomic reload (last-good)
 internal/server/     chi HTTP handlers + Prometheus metrics
 templates/           embedded defaults: kickstart, iPXE, catalog/*.yaml
 docs/                see above