Relocate packaging: RPM, shell completions, no-TTY fix, repaired tests (#13)

## Why

The unit tests stopped compiling after the `--pm` → `-p`/`-i` match-modifier refactor was left uncommitted, there was no RPM/completions distribution story, and invoking the tool without a TTY against an empty pipe silently returned nothing. This makes the project releasable and safe to run from agents/CI.

## Changes

- Make stdin handling robust: replace the fragile `!isTerminal` check with `stdinReader()`, which only reads node names when stdin is a real pipe/redirect carrying data. Terminals, `/dev/null`, and empty/closed pipes now fall through to a normal query, so running without a TTY behaves like an interactive run.
- Repair and expand `main_test.go` to match the current `buildQuery`/`run` signatures; add coverage for the match modifiers, all output modes, config precedence, and the new `stdinReader` logic. `httptest` stubs PuppetDB (no live deps).
- Add nfpm packaging (`packaging/nfpm.yaml`, `scripts/build-rpm.sh`): installs the binary to `/usr/bin/node-lookup` and bundles generated bash/zsh/fish completions under the standard system paths.
- Rework the Makefile to build into `dist/` and add `completions`/`rpm` targets.
- Split PR CI into `build`, `test`, and `pre-commit` workflows and extend `release` to build the RPM and `PUT` it to the artifactapi `rpm-internal` repo. Every step sets a `serviceAccount` and k8s resources.

The project directory has also been relocated under `prodenv`.

Reviewed-on: #13
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

Makefile

@@ -1,13 +1,17 @@
-BINARY   := node-lookup
-VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
-GOFLAGS  := -ldflags="-s -w -X main.version=$(VERSION)"
+BINARY  := node-lookup
+DIST    := dist
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
+OS      ?= $(shell go env GOOS)
+ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: all build test lint clean install patch minor major _tag
+.PHONY: all build test lint fmt clean install completions rpm rpm-package patch minor major _tag
 
 all: build
 
+# Build into dist/ so the nfpm packaging step (scripts/build-rpm.sh) can find it.
 build:
-	go build $(GOFLAGS) -o $(BINARY) ./...
+	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) ./...
 
 test:
 	go test -v -race ./...
@@ -15,12 +19,29 @@ test:
 lint:
 	golangci-lint run ./...
 
+fmt:
+	gofmt -w .
+
 clean:
-	rm -f $(BINARY)
+	rm -rf $(DIST) $(BINARY)
 
 install:
 	go install $(GOFLAGS) ./...
 
+# Generate bash/zsh/fish completions from the built binary into dist/completions.
+completions: build
+	@mkdir -p $(DIST)/completions
+	$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
+	$(DIST)/$(BINARY) completion zsh  > $(DIST)/completions/_$(BINARY)
+	$(DIST)/$(BINARY) completion fish > $(DIST)/completions/$(BINARY).fish
+
+# Build the binary then package it (with completions) into an RPM via nfpm.
+rpm: build rpm-package
+
+# Package an already-built binary into an RPM (used by CI after the build step).
+rpm-package:
+	./scripts/build-rpm.sh $(VERSION)
+
 # Bump helpers — reads the latest semver tag and creates the next one.
 # If no tag exists yet, starts from v0.0.0.
 _LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)