feat: make puppet-initial CA endpoint configurable, default to k8s puppetca

The puppet-initial firstrun bootstrap hardcoded the legacy Consul CA
endpoint puppetca.query.consul:8140. That VM-era CA is being replaced by
the in-cluster puppetserver CA service.

- Default the CA host to puppetca.k8s.syd1.au.unkin.net (still :8140,
  same /puppet-ca/v1/certificate/ca API; verified serving HTTP 200).
- Read PUPPETCA_HOST / PUPPETCA_PORT from the environment so a host can
  be pointed at a different CA without rebuilding the RPM.
- Wire the env through systemd via EnvironmentFile=-/etc/sysconfig/puppet-initial
  and ship a commented %config(noreplace) example at that path, so a
  kickstart %post can override per-host.
- Document the override (incl. a kickstart %post example) in a new README.
- Bump el8/el9 build version 1.0.3 -> 1.0.4 so a new RPM is published.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

rpms/puppet-initial/resources/puppet-initial.sysconfig

@@ -0,0 +1,13 @@
+# Environment overrides for the puppet-initial firstrun bootstrap.
+# Read by the puppet-initial.service unit (EnvironmentFile=-/etc/sysconfig/puppet-initial).
+# A kickstart %post can write this file to point a host at a different Puppet CA
+# without rebuilding the RPM. All values are optional; the defaults below match
+# the shipped in-cluster puppetserver CA service.
+
+# Hostname of the Puppet CA service. Used both to fetch the CA certificate
+# (https://<host>:<port>/puppet-ca/v1/certificate/ca) and as --server for the
+# initial noop agent registration run.
+#PUPPETCA_HOST=puppetca.k8s.syd1.au.unkin.net
+
+# Port the Puppet CA API listens on.
+#PUPPETCA_PORT=8140