Package encapic as an RPM published to rpm-internal

The VM puppet masters are dnf-managed hosts moving off cobbler onto encapi,
and encapic ships only as a release binary the k8s compilers curl.

- drive the release with goreleaser, keeping the encapic_linux_amd64 asset
  and its .sha256 byte-compatible with the compiler initContainer
- build encapic-<version>-1.x86_64.rpm and PUT it to artifactapi rpm-internal
- install /usr/bin/encapic, the /usr/bin/encapic-enc ENC entrypoint and
  /etc/encapic/encapic.conf as %config(noreplace)
- add make rpm/rpm-package/pre-commit and a PR packaging check

Makefile

@@ -5,7 +5,7 @@ GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
 OS      ?= $(shell go env GOOS)
 ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: all build test lint fmt clean install patch minor major _tag
+.PHONY: all build test lint fmt pre-commit clean install rpm rpm-package patch minor major _tag
 
 all: build
 
@@ -22,12 +22,24 @@ lint:
 fmt:
 	gofmt -w .
 
+pre-commit:
+	uvx pre-commit run --all-files
+
 clean:
 	rm -rf $(DIST) $(BINARY)
 
 install:
 	go install $(GOFLAGS) .
 
+# Build every release artifact locally without publishing: the raw binary the
+# puppet compilers fetch, and the RPM the VM masters install.
+rpm: rpm-package
+
+# goreleaser drives the build and the nfpm packaging in one pass, so packaging
+# an already-built binary is not a separate step.
+rpm-package:
+	goreleaser release --snapshot --clean
+
 # Bump helpers — read the latest semver tag and create the next one.
 # If no tag exists yet, start from v0.0.0.
 _LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)