Add the initial repospawner service

repospawner turns JSON new-repo requests into terraform-git pull requests
via kubernetes Jobs, follows those PRs to merge and optionally activates
the repository in Woodpecker.

Dockerfile

@@ -0,0 +1,22 @@
+FROM golang:1.25-alpine AS builder
+
+WORKDIR /build
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION}" -o repospawner ./cmd/repospawner
+
+# distroless static ships ca-certificates and runs as an unprivileged user. The
+# jobs reach the forge, Vault and Woodpecker over HTTP only, so no git binary
+# and no shell are needed at runtime.
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=builder /build/repospawner /usr/local/bin/repospawner
+
+EXPOSE 8080
+
+ENTRYPOINT ["repospawner"]