Move kea entrypoints out of Go fmt.Sprintf into an initContainer

Container entrypoints were rendered as `fmt.Sprintf` shell strings in Go, so
every entrypoint fix needed a full operator release, nothing was shellcheckable,
and the escaping was a hazard.

How:
- Add a `kea-init` initContainer that finalises the per-pod config and
  bounded-waits for HA peer DNS, replacing the in-entrypoint retry. It hardens
  the shared run dir to 0750, substitutes `this-server-name` from the pod
  ordinal (`POD_NAME` via the downward API), stages both configs into the shared
  emptyDir, and gates on `kea-dhcp4 -t` (60x2s) — failing loud after the cap so
  the kubelet restarts it instead of starting a doomed server.
- Run the main kea-dhcp4 / kea-ctrl-agent containers with kea exec'd directly,
  dropping both wrapper shells.
- Replace the two `fmt.Sprintf` entrypoints with a single committed
  `internal/kea/scripts/init.sh` embedded via `go:embed` and parameterised
  entirely by env vars — no Go string interpolation.
- Add a shellcheck step to the pre-commit pipeline.

Test:
- Assert the pod shape: one kea-init initContainer, POD_NAME from the downward
  API, main containers exec kea directly, and the ConfigMap carries init.sh (not
  the old per-container entrypoints).
- Assert init.sh hardens the socket dir, gates on `kea-dhcp4 -t`, fails loud
  after the cap, and is free of fmt verbs.
- shellcheck the embedded script.

internal/kea/agent.go

@@ -1,6 +1,6 @@
 package kea
 
-import "fmt"
+import _ "embed"
 
 type ctrlAgentRoot struct {
 	ControlAgent controlAgent `json:"Control-agent"`
@@ -27,36 +27,15 @@ func RenderCtrlAgent() (string, error) {
 	}})
 }
 
-// EntrypointDHCP4 is the kea-dhcp4 container entrypoint. It derives this pod's
-// HA peer name from the StatefulSet ordinal, substitutes the placeholder in the
-// projected config, and execs the server.
-func EntrypointDHCP4() string {
-	return fmt.Sprintf(`#!/bin/sh
-set -e
-ORD="${HOSTNAME##*-}"
-mkdir -p %[1]s
-chmod 0750 %[1]s
-sed "s/%[2]s/server${ORD}/g" %[3]s/kea-dhcp4.conf > %[4]s
-# The HA hook resolves peer URL hostnames once at load; on a cold container
-# start the StatefulSet peer DNS records may not resolve yet, and kea exits
-# hard instead of retrying. Wait for the config to validate before starting.
-i=0
-until %[5]s -t %[4]s >/dev/null 2>&1; do
-  i=$((i+1))
-  if [ "$i" -ge 60 ]; then break; fi
-  sleep 2
-done
-exec %[5]s -c %[4]s
-`, RunDir, ThisServerPlaceholder, ConfigDir, DHCP4ConfPath, DHCP4Bin)
-}
+// initScript is the initContainer entrypoint. It is a committed, shellcheck-clean
+// shell file (no fmt.Sprintf interpolation) parameterised entirely by the
+// environment variables the operator sets on the initContainer. It prepares the
+// shared run dir, finalises this pod's kea-dhcp4 config from the StatefulSet
+// ordinal, and bounded-waits for the HA peer DNS to resolve before the main
+// kea-dhcp4 / kea-ctrl-agent containers exec kea directly.
+//
+//go:embed scripts/init.sh
+var initScript string
 
-// EntrypointCtrlAgent is the kea-ctrl-agent container entrypoint.
-func EntrypointCtrlAgent() string {
-	return fmt.Sprintf(`#!/bin/sh
-set -e
-mkdir -p %[1]s
-chmod 0750 %[1]s
-cp %[2]s/kea-ctrl-agent.conf %[3]s
-exec %[4]s -c %[3]s
-`, RunDir, ConfigDir, CtrlAgentConfPath, CtrlAgentBin)
-}
+// InitScript returns the initContainer entrypoint shell script.
+func InitScript() string { return initScript }