Publish RPMs to artifactapi rpm-vendor repos (#169)

Why: vendored RPMs currently upload to Gitea's per-distro RPM registry. Publish them instead to the artifactapi per-distro rpm-vendor local repos (real yum repos; repodata regenerates automatically), keeping them separate from in-house software (rpm-internal). The existing per-distro build-all build jobs are unchanged.

Changes:
- .woodpecker/deploy-*.yaml: retarget the deploy-rpms step from git.unkin.net/api/packages/... to a PUT against artifactapi /api/v2/remotes/rpm-vendor-<distro>/files/ (unauthenticated, like the other repos), with an existence probe to skip re-uploads. Drops the DRONECI_PASSWORD secret.
- tools/build: repoint check_package_exists from the Gitea packages API to the artifactapi rpm-vendor repo so build-all's skip check matches the real publish target; verify artifactapi's internal TLS cert against the OS CA bundle; carry arch on PackageInfo so the probed filename matches the built RPM.

Depends on the already-merged rpm-vendor repos (terraform-artifactapi) and pairs with puppet-prod rpm-vendor yumrepo.

Reviewed-on: #169
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

.woodpecker/deploy-almalinux9.yaml

@@ -31,12 +31,18 @@ steps:
     image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
     commands:
       - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-el9"
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
     backend_options:
       kubernetes:
         serviceAccountName: default