initial implementation: encapi ENC server + CLI

Postgres-backed External Node Classifier for Puppet, replacing Cobbler.
- encapi HTTP server (chi + pgx): read/write API + two ENC document shapes
  (reshaped for the exec terminus; cobbler-wire for enc_direct_facts.rb)
- encapi-cli: classify/node/role/status CRUD + import-cobbler seeder
- pkg/client Go SDK; unit tests across all packages (DB via testcontainers)
- Dockerfile (distroless), Makefile, nfpm RPM (encapi-cli + encapi-enc wrapper),
  Woodpecker CI, docs/cutover.md

packaging/enc.conf

@@ -0,0 +1,3 @@
+# encapi CLI configuration, sourced by /usr/local/bin/encapi-enc.
+# Point this at the encapi server. Reads are unauthenticated.
+ENCAPI_URL=https://encapi.k8s.syd1.au.unkin.net

packaging/encapi-enc

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#
+# Puppet ENC entrypoint. Puppet's exec node_terminus invokes:
+#     external_nodes = /usr/local/bin/encapi-enc
+# and calls it as `encapi-enc <certname>`. This shim forwards to
+# `encapi-cli classify <certname>`, sourcing /etc/encapi/enc.conf for
+# ENCAPI_URL (and, if reads were ever locked down, ENCAPI_WRITE_TOKEN).
+set -euo pipefail
+
+[ -r /etc/encapi/enc.conf ] && . /etc/encapi/enc.conf
+
+exec /usr/local/bin/encapi-cli classify "$1"

packaging/nfpm.yaml

@@ -0,0 +1,52 @@
+---
+# nfpm config for the encapi-cli RPM.
+# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - encapi-cli
+provides:
+  - encapi-cli
+
+contents:
+  # The CLI itself.
+  - src: dist/encapi-cli
+    dst: /usr/local/bin/encapi-cli
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Puppet ENC entrypoint (external_nodes = /usr/local/bin/encapi-enc).
+  - src: packaging/encapi-enc
+    dst: /usr/local/bin/encapi-enc
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Sample config; marked noreplace so local edits survive upgrades.
+  - src: packaging/enc.conf
+    dst: /etc/encapi/enc.conf
+    type: config|noreplace
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+
+scripts:
+  preinstall: packaging/scripts/preinstall.sh

packaging/scripts/preinstall.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Ensure the config directory exists before files are laid down.
+mkdir -p /etc/encapi