pdbmux: ship as k8s container, drop per-VM systemd/RPM delivery

The estate direction is all-in-kubernetes, so pdbmux (a long-running daemon)
should run as an in-cluster service rather than an RPM-installed systemd unit
on each VM. The RPM is for workstation/VM CLI tools only; a daemon does not
belong there.

- Remove packaging/pdbmux.service and drop pdbmux (binary, systemd unit,
  completions) from the RPM/nfpm spec and build-rpm.sh.
- Keep pdbmux in the Makefile build and the test suite.
- Add Dockerfile.pdbmux building a static CGO_ENABLED=0 binary on distroless
  (mirrors encapi's image style).
- Add .woodpecker/docker.yaml to build+push git.unkin.net/unkin/pdbmux:<tag>
  on v* tags via the docker-buildx plugin (droneci/DRONECI_PASSWORD creds,
  same as encapi), with k8s resources set.
- Update README/AGENTS.md: deployment is k8s, config via PDBMUX_* env.

Dockerfile.pdbmux

@@ -0,0 +1,24 @@
+# Container image for pdbmux, the merging PuppetDB proxy daemon. This repo ships
+# several CLI tools (node-lookup/pburl/pblastreport) as an RPM, but pdbmux is a
+# k8s-only service, so it gets its own Dockerfile (Dockerfile.pdbmux) and image.
+FROM golang:1.25-alpine AS builder
+
+RUN apk add --no-cache git
+
+WORKDIR /build
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION}" -o pdbmux ./cmd/pdbmux
+
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=builder /build/pdbmux /usr/local/bin/pdbmux
+
+EXPOSE 8080
+
+ENTRYPOINT ["pdbmux", "serve"]