Package as RPM, add completions, fix no-TTY behavior, repair tests

The test suite no longer compiled after the -p/-i match-modifier refactor,
there was no RPM packaging or shell-completion story, and running without a
TTY against an empty pipe silently returned nothing.

- Replace the fragile !isTerminal stdin check with stdinReader(): only read
  node names when stdin is a real pipe/redirect carrying data, so /dev/null,
  terminals, and empty/closed pipes fall through to a normal query (works when
  invoked by an agent/CI with no TTY).
- Rewrite main_test.go to match the current buildQuery/run signatures and add
  coverage for match modifiers, output modes, config precedence, and the new
  stdinReader logic.
- Add nfpm packaging (packaging/nfpm.yaml, scripts/build-rpm.sh) that installs
  the binary to /usr/bin and bundles generated bash/zsh/fish completions.
- Rework the Makefile to build into dist/ and add completions/rpm targets.
- Split the PR CI into build + test + pre-commit workflows and extend release
  to build the RPM and PUT it to the artifactapi rpm-internal repo; every step
  now sets a serviceAccount and k8s resources.

AGENTS.md

@@ -7,20 +7,51 @@
 ## Structure
 
 ```
-main.go        # entire application source
-go.mod         # Go module (module name: node-lookup)
-go.sum         # dependency checksums
-node-lookup    # compiled binary (not committed)
+main.go             # entire application source
+main_test.go        # unit tests (mock PuppetDB via httptest, no live deps)
+go.mod              # Go module (module name: node-lookup)
+go.sum              # dependency checksums
+Makefile            # build / test / lint / completions / rpm / version-bump targets
+packaging/nfpm.yaml # nfpm spec (envsubst-templated) for the RPM
+scripts/build-rpm.sh # generates completions + packages the RPM with nfpm
+.woodpecker/        # CI: build, test, pre-commit (PR) + release (tag)
+dist/               # build output: binary, completions, RPM (not committed)
 ```
 
 ## Build
 
 ```bash
+make build          # -> dist/node-lookup (CGO disabled, static)
+# or directly:
 go build -o node-lookup ./...
 ```
 
 Requires Go 1.21+. Dependencies: `github.com/spf13/cobra` (CLI), `gopkg.in/yaml.v3` (Ansible output).
 
+## Packaging (RPM)
+
+```bash
+make rpm            # build the binary + package it into dist/*.rpm via nfpm
+```
+
+`scripts/build-rpm.sh` generates bash/zsh/fish completions from the built binary
+and bundles them alongside `/usr/bin/node-lookup`. On a `v*` tag the release
+pipeline builds the RPM and `PUT`s it to the artifactapi `rpm-internal` repo.
+
+## Shell completions
+
+Cobra provides a `completion` subcommand:
+
+```bash
+node-lookup completion bash   # or zsh / fish / powershell
+```
+
+The RPM installs completions to the standard system paths
+(`/usr/share/bash-completion/completions/`, `/usr/share/zsh/site-functions/`,
+`/usr/share/fish/vendor_completions.d/`), so they work automatically once
+installed. To load ad-hoc in the current shell, e.g. zsh:
+`source <(node-lookup completion zsh)`.
+
 ## Running the Tool
 
 ```bash
@@ -28,8 +59,10 @@ Requires Go 1.21+. Dependencies: `github.com/spf13/cobra` (CLI), `gopkg.in/yaml.
 ./node-lookup -R                          # show all nodes with role fact
 ./node-lookup -n <hostname>               # lookup a specific node
 ./node-lookup -F <fact_name>              # filter by fact name
-./node-lookup -m <value>                  # exact value match
-./node-lookup --pm <pattern>              # partial/regex match on value
+./node-lookup -m <value>                  # exact value match (-m)
+./node-lookup -pm <value>                 # partial/regex match (-p -m combined)
+./node-lookup -im <value>                 # inverse exact match (-i -m combined)
+./node-lookup -ipm <value>                # inverse partial match (-i -p -m combined)
 ./node-lookup -R -1                       # node names only
 ./node-lookup -R -2                       # values only
 ./node-lookup -R -C                       # count occurrences
@@ -76,11 +109,11 @@ Show the active configuration (after all overrides applied):
 ## Code Patterns
 
 - **`loadConfig()`**: reads config file → applies env vars → returns `config` struct. Called once at startup in `main()`.
-- **`buildQuery()`**: returns a PuppetDB PQL-compatible JSON array string. Uses `roleFact` from config (not hardcoded).
+- **`buildQuery()`**: returns a PuppetDB PQL-compatible JSON array string. Uses `roleFact` from config (not hardcoded). Match modifiers: `-p` (partial/regex, uses `~` op), `-i` (inverse, wraps with `not`), composable.
 - **`queryPuppetDB(url, query)`**: takes the URL as a parameter — never reads globals.
 - **`processResults()`**: iterates facts, returns sorted `"certname value"` strings. JSON string values are unquoted; other JSON types rendered as compact JSON.
 - **Output modes**: JSON (`-j`), count (`-C`), Ansible YAML (`-A`), node-only (`-1`), value-only (`-2`), default (node + value).
-- **Stdin support**: when stdin is not a TTY and no `-n` is given, node names are read line-by-line and queried individually (one HTTP request per node).
+- **Stdin support**: `stdinReader()` reads node names from stdin only when it is a real pipe/redirect carrying data (and no `-n` given). Terminals, `/dev/null`, and empty/closed pipes fall through to a normal query — so running without a TTY (e.g. invoked by an agent or CI) behaves like an interactive run instead of consuming empty input.
 - **SIGPIPE handling**: `signal.Ignore(syscall.SIGPIPE)` so pipes to `head` etc. work cleanly.
 
 ## CLI Framework
@@ -89,7 +122,15 @@ Uses [Cobra](https://github.com/spf13/cobra). Root command is the query command.
 
 ## Testing
 
-No test suite exists. Manual testing requires access to the Consul/PuppetDB environment or a mock HTTP server.
+```bash
+make test           # go test -v -race ./...
+```
+
+`main_test.go` covers query construction (all `-m`/`-p`/`-i` combinations), value
+rendering, result processing/counting, config precedence (defaults < file < env),
+`writeDefaultConfig`, the `stdinReader` no-TTY behavior, and every `run()` output
+mode (default, `-1`, `-2`, `-C`, `-j`, `-A`, `-a`). PuppetDB is stubbed with
+`httptest` — no live Consul/PuppetDB access is required.
 
 ## Gotchas