Add pburl and pblastreport companion tools to the RPM (#15)

## Why

`node-lookup` output is handy for pivoting to Puppetboard, but there was no quick way to turn a list of hosts into Puppetboard node-page URLs, or to see when each host last ran Puppet. These two small tools close that gap and ship in the **same RPM** so they're available wherever `node-lookup` is.

## Changes

- Add **`pburl`**: reads hostnames from args or piped `node-lookup` output (first field of each line, de-duped) and prints `<host> <puppetboard-node-page-url>`.
- Add **`pblastreport`**: prints `<host>\t<last-report-time>\t<url>` using `report_timestamp` from the PuppetDB v4 `nodes` endpoint. Supports `--relative`/`-r` (relative age) and `--timezone`/`-z <IANA>` (default: local timezone).
- Add **`internal/puppet`** package shared by both tools: config load, PuppetDB `nodes` query, Puppetboard URL construction (`<base>/node/<certname>`), and no-TTY-safe stdin host reading.
- Add **`puppetboard_url`** config key (env `NODE_LOOKUP_PUPPETBOARD_URL`, default `https://puppetboard.k8s.syd1.au.unkin.net`) to the shared config so `config init`/`config show` scaffold it for the whole tool family. `node-lookup`'s own query behaviour is unchanged.
- Build all three binaries individually (each is its own `main` package — a single `go build ./...` can't emit multiple mains) and generate per-binary bash/zsh/fish completions in the Makefile, `build-rpm.sh`, and nfpm spec.
- Cross-compile and attach all three tools per os/arch in the release pipeline; extend `.gitignore`; `go mod tidy` promotes cobra/yaml to direct deps.
- Document the tools, config key, and env var in `AGENTS.md`.

## Testing

- `go test -race ./...` passes (new tests cover config precedence, `nodes` endpoint derivation, host-page URLs, `LookupNode`, stdin host parsing, and the report-time formatting incl. timezone/relative/edge cases).
- Built the RPM locally and confirmed it installs all 3 binaries + 9 completion files.
- Smoke-tested both tools end-to-end against a mock PuppetDB (timezone conversion, relative time, and error handling all correct).

No cross-repo changes needed: the release reuses the existing `default` ServiceAccount and the artifactapi `rpm-internal` upload.

Reviewed-on: #15
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

AGENTS.md

@@ -2,22 +2,39 @@
 
 ## Project Overview
 
-`node-lookup` is a Go CLI tool that queries a PuppetDB API to retrieve and filter node facts.
+This repo ships three related Puppet CLIs in one RPM:
+
+- **`node-lookup`** — queries the PuppetDB API to retrieve and filter node facts.
+- **`pburl`** — prints the Puppetboard node-page URL for each host (reads hosts
+  from args or piped `node-lookup` output). Output: `<host> <url>`.
+- **`pblastreport`** — prints each host's last Puppet report time and its
+  Puppetboard URL. Output: `<host>\t<time>\t<url>`. Supports `--relative`/`-r`
+  (relative age) and `--timezone`/`-z <IANA>` (default: local timezone).
+
+`node-lookup` is the module root; `pburl` and `pblastreport` live under `cmd/`
+and share the `internal/puppet` package (config, PuppetDB `nodes` queries,
+Puppetboard URL construction, stdin host reading).
 
 ## Structure
 
 ```
-main.go             # entire application source
-main_test.go        # unit tests (mock PuppetDB via httptest, no live deps)
+main.go                       # node-lookup CLI source (module root, package main)
+main_test.go                  # node-lookup unit tests (mock PuppetDB via httptest)
+cmd/pburl/main.go             # pburl CLI
+cmd/pblastreport/main.go      # pblastreport CLI (report.go: report-time formatting)
+internal/puppet/              # shared: config, puppetdb nodes query, board URLs, stdin
 go.mod              # Go module (module name: node-lookup)
 go.sum              # dependency checksums
 Makefile            # build / test / lint / completions / rpm / version-bump targets
-packaging/nfpm.yaml # nfpm spec (envsubst-templated) for the RPM
+packaging/nfpm.yaml # nfpm spec (envsubst-templated) for the RPM (all 3 binaries)
 scripts/build-rpm.sh # generates completions + packages the RPM with nfpm
 .woodpecker/        # CI: build, test, pre-commit (PR) + release (tag)
-dist/               # build output: binary, completions, RPM (not committed)
+dist/               # build output: binaries, completions, RPM (not committed)
 ```
 
+Every binary is a separate `main` package, so `make build` builds each with its
+own `-o` (a single `go build ./...` can't emit multiple mains to one file).
+
 ## Build
 
 ```bash
@@ -74,6 +91,22 @@ installed. To load ad-hoc in the current shell, e.g. zsh:
 echo -e "node1\nnode2" | ./node-lookup -R # pipe node names via stdin
 ```
 
+### Companion tools
+
+```bash
+node-lookup -R | pburl                    # <host> <puppetboard-url> per line
+pburl host1 host2                          # hosts as args instead of stdin
+
+node-lookup -R | pblastreport              # <host>  <last-report-time>  <url>
+pblastreport -r host1                       # relative age (e.g. "3h ago")
+pblastreport -z Asia/Singapore host1        # render the time in a specific IANA tz
+```
+
+Both read hostnames from arguments or the first field of each piped line (so
+any `node-lookup` output mode works), de-duplicate, and share `node-lookup`'s
+config file / env vars. `pblastreport` reads `report_timestamp` from the
+PuppetDB v4 `nodes` endpoint (derived from the configured facts URL).
+
 ## Configuration
 
 Precedence (lowest → highest): **defaults < config file < env vars < `--url` flag**
@@ -85,6 +118,7 @@ XDG location: `$XDG_CONFIG_HOME/node-lookup/config.yaml` (default: `~/.config/no
 ```yaml
 puppetdb_url: http://puppetdbapi.service.consul:8080/pdb/query/v4/facts
 role_fact: enc_role
+puppetboard_url: https://puppetboard.k8s.syd1.au.unkin.net  # used by pburl / pblastreport
 ```
 
 Generate the default config file:
@@ -103,6 +137,7 @@ Show the active configuration (after all overrides applied):
 |---|---|---|
 | `NODE_LOOKUP_URL` | `puppetdb_url` | PuppetDB facts endpoint |
 | `NODE_LOOKUP_ROLE_FACT` | `role_fact` | Fact name used by `-R` flag |
+| `NODE_LOOKUP_PUPPETBOARD_URL` | `puppetboard_url` | Puppetboard base URL (pburl / pblastreport) |
 
 ### CLI flag