Package encapic as an RPM published to rpm-internal

The VM puppet masters are dnf-managed hosts moving off cobbler onto encapi,
and encapic ships only as a release binary the k8s compilers curl.

- drive the release with goreleaser, keeping the encapic_linux_amd64 asset
  and its .sha256 byte-compatible with the compiler initContainer
- build encapic-<version>-1.x86_64.rpm and PUT it to artifactapi rpm-internal
- install /usr/bin/encapic, the /usr/bin/encapic-enc ENC entrypoint and
  /etc/encapic/encapic.conf as %config(noreplace)
- add make rpm/rpm-package/pre-commit and a PR packaging check

README.md

@@ -69,8 +69,33 @@ make build   # static binary into dist/
 make test    # go test -v -race ./...
 make lint    # golangci-lint
 make fmt     # gofmt -w .
+make rpm     # binary + RPM into dist/ via goreleaser, publishing nothing
 ```
 
 Release: `make minor` (etc.) tags `vX.Y.Z` and pushes it; the `release`
-Woodpecker pipeline builds `encapic_linux_amd64` (+ `.sha256`) and attaches
-them to a Gitea release.
+Woodpecker pipeline runs goreleaser, which attaches `encapic_linux_amd64`
+(+ `.sha256`) and the RPM to a Gitea release, and then publishes the RPM to the
+artifactapi `rpm-internal` yum repo.
+
+## Installation
+
+The kubernetes compilers fetch `encapic_linux_amd64` from the Gitea release in
+an initContainer and install it to `/opt/bin/encapic`.
+
+The VM puppet masters install the RPM from `rpm-internal`:
+
+```
+dnf install encapic
+```
+
+It ships three paths:
+
+- `/usr/bin/encapic` — the binary;
+- `/usr/bin/encapic-enc` — the ENC entrypoint. Puppet's exec `node_terminus`
+  invokes `external_nodes` with a certname and no environment, so the shim
+  sources the URL before exec'ing the binary. Point `external_nodes` at this,
+  not at `/usr/bin/encapic`;
+- `/etc/encapic/encapic.conf` — `ENCAPI_URL=...`, defaulting to the external
+  address `https://encapi.k8s.syd1.au.unkin.net` because a VM cannot resolve
+  the in-cluster default. Shipped `%config(noreplace)` so puppet may own its
+  contents without an upgrade reverting them.