Move kea entrypoints out of Go fmt.Sprintf into an initContainer

Container entrypoints were rendered as `fmt.Sprintf` shell strings in Go, so
every entrypoint fix needed a full operator release, nothing was shellcheckable,
and the escaping was a hazard.

How:
- Add a `kea-init` initContainer that finalises the per-pod config and
  bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens
  the shared run dir to 0750, substitutes `this-server-name` from the pod
  ordinal (`POD_NAME` via the downward API), stages both configs into the shared
  emptyDir, and gates on `kea-dhcp4 -t` (60x2s) — failing loud after the cap so
  the kubelet restarts it instead of starting a doomed server.
- Run the main kea-dhcp4 / kea-ctrl-agent containers with kea exec'd directly,
  dropping both wrapper shells.
- Replace the two `fmt.Sprintf` entrypoints with a single committed
  `internal/kea/scripts/init.sh` embedded via `go:embed` and parameterised
  entirely by env vars — no Go string interpolation.
- Add a shellcheck step to the pre-commit pipeline.

Test:
- Assert the pod shape: one kea-init initContainer, POD_NAME from the downward
  API, main containers exec kea directly, and the ConfigMap carries init.sh (not
  the old per-container entrypoints).
- Assert init.sh hardens the socket dir, gates on `kea-dhcp4 -t`, fails loud
  after the cap, and is free of fmt verbs.
- shellcheck the embedded script.

internal/controller/keacluster_controller.go

@@ -3,6 +3,7 @@ package controller
 import (
 	"context"
 	"fmt"
+	"strconv"
 
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -173,10 +174,9 @@ func (r *KeaClusterReconciler) reconcileConfigMap(ctx context.Context, c *v1alph
 	_, err = ctrl.CreateOrUpdate(ctx, r.Client, cm, func() error {
 		cm.Labels = commonLabels(c.Name)
 		cm.Data = map[string]string{
-			"kea-dhcp4.conf":          dhcp4,
-			"kea-ctrl-agent.conf":     agent,
-			"entrypoint-dhcp4.sh":     kea.EntrypointDHCP4(),
-			"entrypoint-ctrlagent.sh": kea.EntrypointCtrlAgent(),
+			"kea-dhcp4.conf":      dhcp4,
+			"kea-ctrl-agent.conf": agent,
+			"init.sh":             kea.InitScript(),
 		}
 		return ctrl.SetControllerReference(c, cm, r.Scheme)
 	})
@@ -288,10 +288,21 @@ func (r *KeaClusterReconciler) podTemplate(c *v1alpha1.KeaCluster, image, hash s
 		{Name: "run", MountPath: kea.RunDir},
 	}
 
+	// The initContainer finalises the per-pod config and bounded-waits for HA
+	// peer DNS; the main containers then exec kea directly with no wrapper shell.
+	initC := corev1.Container{
+		Name:         kea.ContainerInit,
+		Image:        image,
+		Command:      []string{"/bin/sh", kea.InitScriptPath},
+		Env:          initEnv(),
+		Resources:    c.Spec.Resources,
+		VolumeMounts: mounts,
+	}
+
 	dhcp4 := corev1.Container{
 		Name:      kea.ContainerDHCP4,
 		Image:     image,
-		Command:   []string{"/bin/sh", kea.ConfigDir + "/entrypoint-dhcp4.sh"},
+		Command:   []string{kea.DHCP4Bin, "-c", kea.DHCP4ConfPath},
 		Resources: c.Spec.Resources,
 		Ports: []corev1.ContainerPort{
 			{Name: "dhcp", ContainerPort: kea.DHCP4Port, Protocol: corev1.ProtocolUDP},
@@ -301,7 +312,7 @@ func (r *KeaClusterReconciler) podTemplate(c *v1alpha1.KeaCluster, image, hash s
 	agent := corev1.Container{
 		Name:      kea.ContainerCtrlAgent,
 		Image:     image,
-		Command:   []string{"/bin/sh", kea.ConfigDir + "/entrypoint-ctrlagent.sh"},
+		Command:   []string{kea.CtrlAgentBin, "-c", kea.CtrlAgentConfPath},
 		Resources: c.Spec.Resources,
 		Ports: []corev1.ContainerPort{
 			{Name: "ctrl", ContainerPort: kea.CtrlAgentPort, Protocol: corev1.ProtocolTCP},
@@ -320,15 +331,35 @@ func (r *KeaClusterReconciler) podTemplate(c *v1alpha1.KeaCluster, image, hash s
 			Annotations: map[string]string{"kea.unkin.net/config-hash": hash},
 		},
 		Spec: corev1.PodSpec{
-			Containers:   []corev1.Container{dhcp4, agent},
-			Volumes:      []corev1.Volume{volProjected, volRun},
-			NodeSelector: c.Spec.NodeSelector,
-			Tolerations:  c.Spec.Tolerations,
-			Affinity:     c.Spec.Affinity,
+			InitContainers: []corev1.Container{initC},
+			Containers:     []corev1.Container{dhcp4, agent},
+			Volumes:        []corev1.Volume{volProjected, volRun},
+			NodeSelector:   c.Spec.NodeSelector,
+			Tolerations:    c.Spec.Tolerations,
+			Affinity:       c.Spec.Affinity,
 		},
 	}
 }
 
+// initEnv is the environment the embedded init.sh reads. Passing paths and
+// tunables as env vars (rather than interpolating them into the script text)
+// keeps init.sh static, committed and shellcheck-clean.
+func initEnv() []corev1.EnvVar {
+	return []corev1.EnvVar{
+		{Name: kea.EnvPodName, ValueFrom: &corev1.EnvVarSource{
+			FieldRef: &corev1.ObjectFieldSelector{FieldPath: "metadata.name"},
+		}},
+		{Name: kea.EnvRunDir, Value: kea.RunDir},
+		{Name: kea.EnvConfigDir, Value: kea.ConfigDir},
+		{Name: kea.EnvThisServerPlaceholder, Value: kea.ThisServerPlaceholder},
+		{Name: kea.EnvDHCP4Bin, Value: kea.DHCP4Bin},
+		{Name: kea.EnvDHCP4Conf, Value: kea.DHCP4ConfPath},
+		{Name: kea.EnvCtrlAgentConf, Value: kea.CtrlAgentConfPath},
+		{Name: kea.EnvWaitAttempts, Value: strconv.Itoa(kea.WaitAttempts)},
+		{Name: kea.EnvWaitSleep, Value: strconv.Itoa(kea.WaitSleepSeconds)},
+	}
+}
+
 // reloadReadyPods best-effort hot-reloads config on ready pods via the
 // ctrl-agent REST channel, analogous to bind-operator's rndc reconfig.
 func (r *KeaClusterReconciler) reloadReadyPods(ctx context.Context, c *v1alpha1.KeaCluster) {