Publish RPMs to artifactapi rpm-vendor repos

Vendored RPMs currently upload to Gitea's per-distro RPM registry. Publish
them instead to the artifactapi per-distro rpm-vendor local repos (real yum
repos; repodata regenerates automatically), keeping them separate from
in-house software (rpm-internal). The build jobs are unchanged (build-all
per distro).

- .woodpecker/deploy-*.yaml: retarget the deploy-rpms step from
  git.unkin.net/api/packages/... to a PUT against artifactapi
  /api/v2/remotes/rpm-vendor-<distro>/files/ (unauthenticated, like the other
  repos), with an existence probe to skip re-uploads. Drops the
  DRONECI_PASSWORD secret.
- tools/build: repoint check_package_exists from the Gitea packages API to
  the artifactapi rpm-vendor repo so build-all's skip check matches the real
  publish target; verify artifactapi's internal TLS cert against the OS CA
  bundle; carry arch on PackageInfo so the probed filename matches the RPM.

.woodpecker/deploy-fedora44.yaml

@@ -31,12 +31,18 @@ steps:
     image: git.unkin.net/unkin/fedora44-rpmbuilder:latest
     commands:
       - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-f44"
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/fedora/44/upload
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
     backend_options:
       kubernetes:
         serviceAccountName: default