node-lookup: auto-qualify short node names to .main.unkin.net

Short -n node names (no dot) now silently returned nothing because the
PuppetDB certname filter needs a FQDN. Auto-qualify a dotless name to
<name>.<domain> (domain defaults to main.unkin.net) before the query.

- Add qualifyNode() pure helper: dotless names get .<domain> appended;
  names already containing a dot (any domain) are left unchanged; a single
  trailing dot is stripped; empty input is preserved.
- Apply it to the -n value and to stdin-sourced node names in run().
- Make the domain configurable via config key domain, NODE_LOOKUP_DOMAIN
  env var, and --domain flag (default main.unkin.net).
- Surface domain in config show / config init and document in AGENTS.md.
- Add table-driven qualifyNode tests and a domain env-override test.

AGENTS.md

@@ -138,10 +138,12 @@ Show the active configuration (after all overrides applied):
 | `NODE_LOOKUP_URL` | `puppetdb_url` | PuppetDB facts endpoint |
 | `NODE_LOOKUP_ROLE_FACT` | `role_fact` | Fact name used by `-R` flag |
 | `NODE_LOOKUP_PUPPETBOARD_URL` | `puppetboard_url` | Puppetboard base URL (pburl / pblastreport) |
+| `NODE_LOOKUP_DOMAIN` | `domain` | Domain appended to short (dotless) `-n` node names (default `main.unkin.net`) |
 
-### CLI flag
+### CLI flags
 
 `--url <url>` overrides the PuppetDB URL for a single invocation (highest precedence).
+`--domain <domain>` overrides the auto-qualify domain for a single invocation.
 
 ## Code Patterns
 
@@ -152,6 +154,7 @@ Show the active configuration (after all overrides applied):
 - **`queryPuppetDB(url, query)`**: takes the URL as a parameter — never reads globals.
 - **`processResults()`**: iterates facts, returns sorted `"certname value"` strings. JSON string values are unquoted; other JSON types rendered as compact JSON.
 - **Output modes**: JSON (`-j`), count (`-C`), Ansible YAML (`-A`), node-only (`-1`), value-only (`-2`), default (node + value). `-j` and `-A` share `factsByHost()`, so both attach the queried fact(s) per host — as an object under the host (`-j`) or as inventory host vars (`-A`).
+- **Short node names / `qualifyNode()`**: a `-n` value (and stdin-sourced node names) with no dot is auto-qualified to `<name>.<domain>` (domain defaults to `main.unkin.net`, overridable via `--domain`/`NODE_LOOKUP_DOMAIN`), so `-n ausyd1nxvm2120` resolves the same as its FQDN. A name that already contains a dot (any domain) is left unchanged; a single trailing dot is stripped; empty input is preserved.
 - **Stdin support**: `stdinReader()` reads node names from stdin only when it is a real pipe/redirect carrying data (and no `-n` given). Terminals, `/dev/null`, and empty/closed pipes fall through to a normal query — so running without a TTY (e.g. invoked by an agent or CI) behaves like an interactive run instead of consuming empty input.
 - **SIGPIPE handling**: `signal.Ignore(syscall.SIGPIPE)` so pipes to `head` etc. work cleanly.