refactor: modernise RPM builder with Python tooling v2

- Migrate from legacy shell-based build system to modern Python tooling
- Update all metadata.yaml files to new schema with per-distro builds
- Standardise build scripts with curl -L, envsubst, and error handling
- Convert nfpm.yaml templates to use environment variable substitution
- Update Dockerfile to accept all package metadata as build arguments
- Modernise Makefile to use new Python build tool commands
- Update CI workflow to use tools/build instead of make

rpms/unkin-ca-certificates/resources/build.sh

@@ -1,7 +1,11 @@
 #!/usr/bin/bash
 
-# Download the CA certificate from vault
-curl -o /app/UNKIN_ROOTCA_2024.crt https://vault.query.consul:8200/v1/pki_root/ca/pem
+set -e
 
-# Build the RPM
-nfpm pkg --config /app/resources/nfpm.yaml --target /app/dist --packager rpm
+# Download the CA certificate from vault
+curl -L -o /app/UNKIN_ROOTCA_2024.crt https://vault.query.consul:8200/v1/pki_root/ca/pem
+
+# Process the nfpm.yaml template with environment variables
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm