pdbmux: ship as k8s container, drop per-VM systemd/RPM delivery

The estate direction is all-in-kubernetes, so pdbmux (a long-running daemon)
should run as an in-cluster service rather than an RPM-installed systemd unit
on each VM. The RPM is for workstation/VM CLI tools only; a daemon does not
belong there.

- Remove packaging/pdbmux.service and drop pdbmux (binary, systemd unit,
  completions) from the RPM/nfpm spec and build-rpm.sh.
- Keep pdbmux in the Makefile build and the test suite.
- Add Dockerfile.pdbmux building a static CGO_ENABLED=0 binary on distroless
  (mirrors encapi's image style).
- Add .woodpecker/docker.yaml to build+push git.unkin.net/unkin/pdbmux:<tag>
  on v* tags via the docker-buildx plugin (droneci/DRONECI_PASSWORD creds,
  same as encapi), with k8s resources set.
- Update README/AGENTS.md: deployment is k8s, config via PDBMUX_* env.

packaging/nfpm.yaml

@@ -42,18 +42,12 @@ contents:
       mode: 0755
       owner: root
       group: root
-  - src: dist/pdbmux
-    dst: /usr/bin/pdbmux
-    file_info:
-      mode: 0755
-      owner: root
-      group: root
 
-  # systemd unit for the pdbmux proxy daemon (config: /etc/pdbmux/config.yaml).
-  - src: packaging/pdbmux.service
-    dst: /usr/lib/systemd/system/pdbmux.service
-    file_info:
-      mode: 0644
+  # NOTE: pdbmux is intentionally NOT shipped in this RPM. It is a k8s-only
+  # daemon (deployed via argocd-apps as a container image), not a workstation/VM
+  # CLI tool, so it has no place in the CLI package. pdbmux is still built and
+  # tested in this repo (see Makefile) and released as a container image
+  # (.woodpecker/docker.yaml).
 
   # Shell completions (generated by scripts/build-rpm.sh before packaging).
   - src: dist/completions/node-lookup.bash
@@ -92,15 +86,3 @@ contents:
     dst: /usr/share/fish/vendor_completions.d/pblastreport.fish
     file_info:
       mode: 0644
-  - src: dist/completions/pdbmux.bash
-    dst: /usr/share/bash-completion/completions/pdbmux
-    file_info:
-      mode: 0644
-  - src: dist/completions/_pdbmux
-    dst: /usr/share/zsh/site-functions/_pdbmux
-    file_info:
-      mode: 0644
-  - src: dist/completions/pdbmux.fish
-    dst: /usr/share/fish/vendor_completions.d/pdbmux.fish
-    file_info:
-      mode: 0644

packaging/pdbmux.service

@@ -1,31 +0,0 @@
-[Unit]
-Description=pdbmux - merging proxy over old + new PuppetDB during migration
-Documentation=https://git.unkin.net/unkin/node-lookup
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-# Configure via /etc/pdbmux/config.yaml or PDBMUX_* env in this file / a drop-in.
-# Example env overrides:
-#   Environment=PDBMUX_LISTEN=:8080
-#   Environment=PDBMUX_MERGE=freshness
-Environment=XDG_CONFIG_HOME=/etc
-ExecStart=/usr/bin/pdbmux serve
-Restart=on-failure
-RestartSec=5
-
-# Hardening: pdbmux only makes outbound HTTP(S) and listens on a socket.
-DynamicUser=yes
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=yes
-PrivateTmp=yes
-PrivateDevices=yes
-ProtectKernelTunables=yes
-ProtectControlGroups=yes
-RestrictAddressFamilies=AF_INET AF_INET6
-RestrictNamespaces=yes
-
-[Install]
-WantedBy=multi-user.target