node-lookup: auto-qualify short node names to .main.unkin.net

Short -n node names (no dot) now silently returned nothing because the
PuppetDB certname filter needs a FQDN. Auto-qualify a dotless name to
<name>.<domain> (domain defaults to main.unkin.net) before the query.

- Add qualifyNode() pure helper: dotless names get .<domain> appended;
  names already containing a dot (any domain) are left unchanged; a single
  trailing dot is stripped; empty input is preserved.
- Apply it to the -n value and to stdin-sourced node names in run().
- Make the domain configurable via config key domain, NODE_LOOKUP_DOMAIN
  env var, and --domain flag (default main.unkin.net).
- Surface domain in config show / config init and document in AGENTS.md.
- Add table-driven qualifyNode tests and a domain env-override test.

main_test.go

@@ -167,6 +167,35 @@ func TestSplitFactNames(t *testing.T) {
 	}
 }
 
+func TestQualifyNode(t *testing.T) {
+	const domain = "main.unkin.net"
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"short name appends domain", "ausyd1nxvm2120", "ausyd1nxvm2120.main.unkin.net"},
+		{"fqdn in default domain unchanged", "ausyd1nxvm2120.main.unkin.net", "ausyd1nxvm2120.main.unkin.net"},
+		{"multi-label fqdn other domain unchanged", "foo.k8s.syd1.au.unkin.net", "foo.k8s.syd1.au.unkin.net"},
+		{"short name with trailing dot qualified", "ausyd1nxvm2120.", "ausyd1nxvm2120.main.unkin.net"},
+		{"fqdn with trailing dot stripped", "foo.main.unkin.net.", "foo.main.unkin.net"},
+		{"empty unchanged", "", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := qualifyNode(tc.in, domain); got != tc.want {
+				t.Fatalf("qualifyNode(%q, %q) = %q, want %q", tc.in, domain, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestQualifyNode_CustomDomain(t *testing.T) {
+	if got := qualifyNode("host1", "example.com"); got != "host1.example.com" {
+		t.Fatalf("qualifyNode with custom domain = %q, want host1.example.com", got)
+	}
+}
+
 func TestBuildQuery_SingleFact_NoOr(t *testing.T) {
 	q := buildQuery("", "ipaddress", "", "enc_role", false, false, false)
 	if strings.Contains(q, `"or"`) {
@@ -397,6 +426,22 @@ func TestLoadConfig_Defaults(t *testing.T) {
 	if cfg.RoleFact != defaultRoleFact {
 		t.Fatalf("expected default role fact, got %s", cfg.RoleFact)
 	}
+	if cfg.Domain != defaultDomain {
+		t.Fatalf("expected default domain, got %s", cfg.Domain)
+	}
+}
+
+func TestLoadConfig_DomainEnvOverride(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	t.Setenv("NODE_LOOKUP_DOMAIN", "example.com")
+
+	cfg, err := loadConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Domain != "example.com" {
+		t.Fatalf("domain env override failed: %s", cfg.Domain)
+	}
 }
 
 func TestLoadConfig_EnvOverride(t *testing.T) {