Move kea entrypoints out of Go fmt.Sprintf into an initContainer

Container entrypoints were rendered as `fmt.Sprintf` shell strings in Go, so
every entrypoint fix needed a full operator release, nothing was shellcheckable,
and the escaping was a hazard.

How:
- Add a `kea-init` initContainer that finalises the per-pod config and
  bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens
  the shared run dir to 0750, substitutes `this-server-name` from the pod
  ordinal (`POD_NAME` via the downward API), stages both configs into the shared
  emptyDir, and gates on `kea-dhcp4 -t` (60x2s) — failing loud after the cap so
  the kubelet restarts it instead of starting a doomed server.
- Run the main kea-dhcp4 / kea-ctrl-agent containers with kea exec'd directly,
  dropping both wrapper shells.
- Replace the two `fmt.Sprintf` entrypoints with a single committed
  `internal/kea/scripts/init.sh` embedded via `go:embed` and parameterised
  entirely by env vars — no Go string interpolation.
- Add a shellcheck step to the pre-commit pipeline.

Test:
- Assert the pod shape: one kea-init initContainer, POD_NAME from the downward
  API, main containers exec kea directly, and the ConfigMap carries init.sh (not
  the old per-container entrypoints).
- Assert init.sh hardens the socket dir, gates on `kea-dhcp4 -t`, fails loud
  after the cap, and is free of fmt verbs.
- shellcheck the embedded script.

internal/controller/keacluster_test.go

@@ -91,6 +91,95 @@ func TestKeaClusterReconcileCreatesWorkload(t *testing.T) {
 	}
 }
 
+// TestReconcileWiresInitContainer asserts the entrypoint refactor's pod shape:
+// a kea-init initContainer prepares config + waits for HA peer DNS, and the two
+// main containers exec kea directly with no wrapper shell. The init script comes
+// from the ConfigMap (so its hash rolls the STS), and the old per-container
+// entrypoint scripts are gone.
+func TestReconcileWiresInitContainer(t *testing.T) {
+	scheme := testScheme(t)
+	cluster := newClusterFixture()
+	cl := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithStatusSubresource(&v1alpha1.KeaCluster{}).
+		WithObjects(cluster).
+		Build()
+	r := &KeaClusterReconciler{Client: cl, Scheme: scheme}
+	if _, err := r.Reconcile(context.Background(), ctrl.Request{NamespacedName: types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}}); err != nil {
+		t.Fatalf("reconcile: %v", err)
+	}
+
+	// ConfigMap carries init.sh and no longer the per-container entrypoints.
+	var cm corev1.ConfigMap
+	if err := cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: "pxe-config"}, &cm); err != nil {
+		t.Fatalf("configmap not created: %v", err)
+	}
+	if cm.Data["init.sh"] == "" {
+		t.Errorf("configmap missing init.sh")
+	}
+	for _, gone := range []string{"entrypoint-dhcp4.sh", "entrypoint-ctrlagent.sh"} {
+		if _, ok := cm.Data[gone]; ok {
+			t.Errorf("configmap must not still carry %q", gone)
+		}
+	}
+
+	var sts appsv1.StatefulSet
+	if err := cl.Get(context.Background(), types.NamespacedName{Namespace: "dhcp-system", Name: "pxe"}, &sts); err != nil {
+		t.Fatalf("statefulset not created: %v", err)
+	}
+	spec := sts.Spec.Template.Spec
+
+	// Exactly one initContainer, named kea-init, running init.sh with POD_NAME
+	// sourced from the downward API.
+	if len(spec.InitContainers) != 1 || spec.InitContainers[0].Name != "kea-init" {
+		t.Fatalf("expected one kea-init initContainer, got %#v", spec.InitContainers)
+	}
+	initC := spec.InitContainers[0]
+	if got := initC.Command; len(got) != 2 || got[0] != "/bin/sh" || got[1] != "/etc/kea-operator/init.sh" {
+		t.Errorf("init command = %v, want [/bin/sh /etc/kea-operator/init.sh]", got)
+	}
+	var podNameFromDownward bool
+	for _, e := range initC.Env {
+		if e.Name == "POD_NAME" && e.ValueFrom != nil && e.ValueFrom.FieldRef != nil && e.ValueFrom.FieldRef.FieldPath == "metadata.name" {
+			podNameFromDownward = true
+		}
+	}
+	if !podNameFromDownward {
+		t.Errorf("init container must source POD_NAME from downward API metadata.name, env=%#v", initC.Env)
+	}
+
+	// Main containers exec kea directly (no /bin/sh wrapper).
+	wantCmd := map[string][]string{
+		"kea-dhcp4":      {"/usr/sbin/kea-dhcp4", "-c", "/var/run/kea/kea-dhcp4.conf"},
+		"kea-ctrl-agent": {"/usr/sbin/kea-ctrl-agent", "-c", "/var/run/kea/kea-ctrl-agent.conf"},
+	}
+	for _, ctr := range spec.Containers {
+		want, ok := wantCmd[ctr.Name]
+		if !ok {
+			t.Errorf("unexpected container %q", ctr.Name)
+			continue
+		}
+		if len(ctr.Command) == 0 || ctr.Command[0] == "/bin/sh" {
+			t.Errorf("container %q must exec kea directly, got %v", ctr.Name, ctr.Command)
+		}
+		if !equalStrings(ctr.Command, want) {
+			t.Errorf("container %q command = %v, want %v", ctr.Name, ctr.Command, want)
+		}
+	}
+}
+
+func equalStrings(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
 // TestConfigHashChangesWithSubnets guards the roll trigger: adding a subnet
 // must change the pod-template config hash (so the STS rolls).
 func TestConfigHashChangesWithSubnets(t *testing.T) {