Scaffold kea-operator: CRDs, controllers, config rendering, REST API, CI

Replace the ISC dhcpd PXE-boot VM with a Kea DHCP Kubernetes operator, modelled
on bind-operator. The operator renders kea-dhcp4 config from CRs and runs an HA
pair of kea-dhcp4 + kea-ctrl-agent servers behind an anycast Service.

- add KeaCluster/KeaSubnet/KeaClientClass/KeaAPI CRDs (group kea.unkin.net)
- render deterministic kea-dhcp4.conf + kea-ctrl-agent.conf into a ConfigMap and
  roll the StatefulSet via a config-hash annotation; best-effort hot-reload via
  the kea-ctrl-agent REST channel
- run HA hot-standby (memfile leases) with stable per-peer DNS identity from a
  StatefulSet; expose an anycast LoadBalancer Service for PureLB
- represent the full legacy dhcpd config: 198.18.13-17.0/24 pools, pool-less
  198.18.25.0/24, and the Legacy/UEFI-64 PXE arch classes (option 93)
- add the KeaAPI-spawned REST service: Terraform-friendly CRUD over subnet and
  client-class CRs (stable IDs, PUT upsert, 404 drift, bearer-token auth)
- add Makefile (patch/minor/major tag targets), distroless operator/api images,
  an AlmaLinux+EPEL kea workload image, and woodpecker CI with k8s resources +
  serviceAccountName on every step
- unit tests for config rendering, controller reconcile/config-hash, and the API

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

Makefile

@@ -0,0 +1,63 @@
+.PHONY: build build-api test lint fmt generate manifests docker-operator docker-api docker-kea clean tidy patch minor major
+
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
+BINARY_OP := bin/kea-operator
+BINARY_API := bin/kea-api
+CRD_BUNDLE := config/crd/install.yaml
+
+build: tidy
+	go build -ldflags="-s -w" -o $(BINARY_OP) ./cmd/operator
+
+build-api: tidy
+	go build -ldflags="-s -w" -o $(BINARY_API) ./cmd/api
+
+test:
+	go test -race -count=1 ./api/... ./internal/...
+
+lint:
+	go vet ./...
+
+fmt:
+	gofmt -w .
+
+generate:
+	controller-gen object paths="./api/..."
+	controller-gen crd paths="./api/..." output:crd:artifacts:config=config/crd/bases
+	controller-gen rbac:roleName=kea-operator paths="./internal/controller/..." output:rbac:dir=config/rbac
+	printf '# Generated by "make generate". DO NOT EDIT.\n' > $(CRD_BUNDLE)
+	cat config/crd/bases/*.yaml >> $(CRD_BUNDLE)
+
+manifests: generate
+
+docker-operator:
+	docker build -t kea-operator:$(VERSION) -f Dockerfile.operator .
+
+docker-api:
+	docker build -t kea-api:$(VERSION) -f Dockerfile.api .
+
+docker-kea:
+	docker build -t kea:$(VERSION) -f Dockerfile.kea .
+
+clean:
+	rm -rf bin/
+
+tidy:
+	go mod tidy
+
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW