pdbmux: ship as k8s container, drop per-VM systemd/RPM delivery

The estate direction is all-in-kubernetes, so pdbmux (a long-running daemon)
should run as an in-cluster service rather than an RPM-installed systemd unit
on each VM. The RPM is for workstation/VM CLI tools only; a daemon does not
belong there.

- Remove packaging/pdbmux.service and drop pdbmux (binary, systemd unit,
  completions) from the RPM/nfpm spec and build-rpm.sh.
- Keep pdbmux in the Makefile build and the test suite.
- Add Dockerfile.pdbmux building a static CGO_ENABLED=0 binary on distroless
  (mirrors encapi's image style).
- Add .woodpecker/docker.yaml to build+push git.unkin.net/unkin/pdbmux:<tag>
  on v* tags via the docker-buildx plugin (droneci/DRONECI_PASSWORD creds,
  same as encapi), with k8s resources set.
- Update README/AGENTS.md: deployment is k8s, config via PDBMUX_* env.

AGENTS.md

@@ -33,10 +33,10 @@ internal/puppet/              # shared: config, puppetdb nodes query, board URLs
 go.mod              # Go module (module name: node-lookup)
 go.sum              # dependency checksums
 Makefile            # build / test / lint / completions / rpm / version-bump targets
-packaging/nfpm.yaml # nfpm spec (envsubst-templated) for the RPM (all 4 binaries)
-packaging/pdbmux.service # systemd unit for the pdbmux daemon
+packaging/nfpm.yaml # nfpm spec (envsubst-templated) for the RPM (CLI tools only)
+Dockerfile.pdbmux   # container image for the k8s-only pdbmux daemon
 scripts/build-rpm.sh # generates completions + packages the RPM with nfpm
-.woodpecker/        # CI: build, test, pre-commit (PR) + release (tag)
+.woodpecker/        # CI: build, test, pre-commit (PR) + release/docker (tag)
 dist/               # build output: binaries, completions, RPM (not committed)
 ```
 
@@ -63,6 +63,13 @@ make rpm            # build the binary + package it into dist/*.rpm via nfpm
 and bundles them alongside `/usr/bin/node-lookup`. On a `v*` tag the release
 pipeline builds the RPM and `PUT`s it to the artifactapi `rpm-internal` repo.
 
+The RPM contains the workstation/VM CLI tools only (`node-lookup`, `pburl`,
+`pblastreport`). `pdbmux` is a k8s-only daemon and is deliberately excluded from
+the RPM — it is released as a container image
+(`git.unkin.net/unkin/pdbmux:<tag>`, built by `.woodpecker/docker.yaml` from
+`Dockerfile.pdbmux`) and deployed via `argocd-apps`. `make build` and
+`go test ./...` still cover pdbmux.
+
 ## Shell completions
 
 Cobra provides a `completion` subcommand: