Publish vendor RPMs to artifactapi rpm-vendor, one package per job

Builds currently push to Gitea's RPM registry and run build-all in a single
job. Publish instead to the artifactapi rpm-vendor local repos (real yum
repos; repodata regenerates automatically) and give each vendor package its
own job so failures are isolated and builds parallelise. Because builds no
longer land in Gitea, the "skip already-built version" check now probes
artifactapi.

- tools/build: repoint check_package_exists from the Gitea packages API to
  the artifactapi rpm-vendor repo (GET the served Packages/<file>.rpm path).
  Add get_vendor_repo() (distro -> rpm-vendor-<suffix>) and get_rpm_arch()
  (amd64 -> x86_64), and carry arch on PackageInfo so the probed filename
  matches the built RPM.
- .woodpecker: replace the per-distro build-all pipelines with per-distro
  matrix pipelines over PACKAGE, so each package builds in its own job.
  deploy-*.yaml (master push) build each package and PUT its RPM to the
  distro's rpm-vendor repo; build-*.yaml (pull_request) build as a check.
- tools/gen-pipelines + `make pipelines`: generate the .woodpecker matrix
  pipelines from rpms/*/metadata.yaml (source of truth for target distros);
  regenerate after adding or removing packages.

.woodpecker/deploy-almalinux8.yaml

@@ -1,14 +1,89 @@
+# Generated by tools/gen-pipelines - do not edit by hand.
 when:
   - event: push
     branch: master
 
+matrix:
+  PACKAGE:
+    - act_runner
+    - bind_exporter
+    - boilerplate
+    - claude-code
+    - cni-plugins
+    - code-server
+    - consul
+    - consul-cni
+    - etcd
+    - exportarr
+    - frr_exporter
+    - g10k
+    - git-delta
+    - hadolint
+    - helm
+    - helmfile
+    - jellyfin-ffmpeg-bin
+    - jellyfin-server
+    - jellyfin-web
+    - jsonnet
+    - jsonnet-language-server
+    - jsonnet-lint
+    - kubecolor
+    - kubeconform
+    - kubectx
+    - kustomize
+    - lazydocker
+    - libfoundationdb
+    - neovim
+    - neovim-glibc-2.17
+    - nfpm
+    - node_exporter
+    - nomad
+    - nomad-autoscaler
+    - nzbget
+    - nzbget_exporter
+    - openbao-plugin-secret-consul
+    - openbao-plugin-secret-nomad
+    - openbao-plugins
+    - packer
+    - pgbouncer_exporter
+    - postgres_exporter
+    - puppet-initial
+    - puppetdb_exporter
+    - ruff
+    - sops
+    - stalwart
+    - stalwart-cli
+    - stalwart-foundationdb
+    - starship
+    - stern
+    - tea
+    - terraform
+    - terragrunt
+    - tflint
+    - unkin-ca-certificates
+    - unkin-undionly-kpxe
+    - unrar
+    - uv
+    - vals
+    - vault
+    - victoria-logs
+    - vlutils
+    - vmagent
+    - vmalert
+    - vminsert
+    - vmselect
+    - vmstorage
+    - vmutils
+    - xh
+    - yq
+
 steps:
-  - name: build-rpms
+  - name: build
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - ./tools/build build-all --distro almalinux/el8 --buildah
+      - ./tools/build build --distro almalinux/el8 --buildah "$PACKAGE"
     privileged: true
     backend_options:
       kubernetes:
@@ -21,22 +96,27 @@ steps:
             memory: 2Gi
             cpu: 2
 
-  - name: show-rpms
+  - name: upload
     image: git.unkin.net/unkin/almalinux9-base:latest
-    commands:
-      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
-    depends_on: [build-rpms]
-
-  - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - |
-        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-el8"
+        for rpm in $(find dist -type f -name '*.rpm'); do
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            continue
+          fi
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
         done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
+    depends_on: [build]
     backend_options:
       kubernetes:
         serviceAccountName: default
@@ -47,4 +127,3 @@ steps:
           limits:
             memory: 512Mi
             cpu: 500m
-    depends_on: [build-rpms, show-rpms]