Scaffold kea-operator: CRDs, controllers, config rendering, REST API, CI

Replace the ISC dhcpd PXE-boot VM with a Kea DHCP Kubernetes operator, modelled
on bind-operator. The operator renders kea-dhcp4 config from CRs and runs an HA
pair of kea-dhcp4 + kea-ctrl-agent servers behind an anycast Service.

- add KeaCluster/KeaSubnet/KeaClientClass/KeaAPI CRDs (group kea.unkin.net)
- render deterministic kea-dhcp4.conf + kea-ctrl-agent.conf into a ConfigMap and
  roll the StatefulSet via a config-hash annotation; best-effort hot-reload via
  the kea-ctrl-agent REST channel
- run HA hot-standby (memfile leases) with stable per-peer DNS identity from a
  StatefulSet; expose an anycast LoadBalancer Service for PureLB
- represent the full legacy dhcpd config: 198.18.13-17.0/24 pools, pool-less
  198.18.25.0/24, and the Legacy/UEFI-64 PXE arch classes (option 93)
- add the KeaAPI-spawned REST service: Terraform-friendly CRUD over subnet and
  client-class CRs (stable IDs, PUT upsert, 404 drift, bearer-token auth)
- add Makefile (patch/minor/major tag targets), distroless operator/api images,
  an AlmaLinux+EPEL kea workload image, and woodpecker CI with k8s resources +
  serviceAccountName on every step
- unit tests for config rendering, controller reconcile/config-hash, and the API

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

Dockerfile.kea

@@ -0,0 +1,20 @@
+# Kea DHCPv4 workload image (kea-dhcp4 + kea-ctrl-agent + HA/lease hooks).
+# ISC publishes no official Kea container, so we build our own from AlmaLinux,
+# which is already reachable through the artifactapi dockerhub remote
+# (^library/almalinux). The kea packages come from EPEL; the HA hook
+# (libdhcp_ha.so) and lease_cmds hook ship open-source since Kea 2.4.
+#
+# NOTE: this build needs EPEL package access. If the CI build network cannot
+# reach EPEL mirrors, add an artifactapi rpm remote for EPEL (see repo README
+# follow-ups) and point dnf at it.
+FROM almalinux:9
+
+RUN dnf -y install epel-release \
+ && dnf -y install kea kea-hooks \
+ && dnf clean all \
+ && rm -rf /var/cache/dnf \
+ && mkdir -p /run/kea
+
+EXPOSE 67/udp 8000/tcp
+# Command is supplied by the operator (per-container entrypoint scripts).
+CMD ["/usr/sbin/kea-dhcp4", "-c", "/etc/kea/kea-dhcp4.conf"]