Make certmanager a drop-in for the Python script

Puppet calls /usr/local/bin/certmanager from generate() with combine: true, so
the CLI must take the common name positionally and keep stderr clean or the
catalog compile dies on a parsejson error.

- Flatten the CLI: drop the pki subcommand, add -a/-i/-e/-c/--json
- Emit ca_certificate so vault.pp stops writing undef to that file
- Read output_path from under vault:, where Puppet writes it
- Bound every Vault request with a timeout; exit non-zero on failure
- Gate TLS verification on vault.tls_skip_verify (default true)
- Restrict auth to approle and kubernetes, no fallback between them
- Remove the SSH half; add Woodpecker CI, nfpm RPM and completions

packaging/nfpm.yaml

@@ -0,0 +1,50 @@
+---
+# nfpm config for building the certmanager RPM.
+# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - certmanager
+provides:
+  - certmanager
+
+contents:
+  - src: dist/certmanager
+    dst: /usr/bin/certmanager
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Puppet's profiles::pki::vault calls the binary at this hardcoded path.
+  - src: /usr/bin/certmanager
+    dst: /usr/local/bin/certmanager
+    type: symlink
+
+  # Shell completions (generated by scripts/build-rpm.sh before packaging).
+  - src: dist/completions/certmanager.bash
+    dst: /usr/share/bash-completion/completions/certmanager
+    file_info:
+      mode: 0644
+  - src: dist/completions/_certmanager
+    dst: /usr/share/zsh/site-functions/_certmanager
+    file_info:
+      mode: 0644
+  - src: dist/completions/certmanager.fish
+    dst: /usr/share/fish/vendor_completions.d/certmanager.fish
+    file_info:
+      mode: 0644