refactor: modernise RPM builder with Python tooling

- Replace Makefile version/release file system with metadata.yaml only
- Add Python build automation (./tools/build) with Gitea API integration
- Add GitHub release updater (./tools/update-gh) for version management
- Centralize Dockerfiles into single parameterized Dockerfile
- Remove 54+ individual package Dockerfiles and version directories
- Update Makefile to use new Python tooling
- Add GITEA_API_TOKEN validation to prevent duplicate builds
- Support both explicit version/release args and metadata.yaml reading

tools/build

@@ -47,8 +47,11 @@ def get_vault_client() -> hvac.Client:
         logger.error("VAULT_ROLE_ID environment variable is required")
         raise ValueError("VAULT_ROLE_ID environment variable is required")
 
-    # Initialize Vault client
+    # Initialize Vault client with CA certificate
-    client = hvac.Client(url=vault_addr)
+    client = hvac.Client(
+        url=vault_addr,
+        verify='/etc/pki/tls/cert.pem'
+    )
 
     # Authenticate using AppRole
     try:
@@ -84,6 +87,7 @@ def get_api_tokens() -> Tuple[str, str]:
     # Read GitHub token
     try:
         github_secret = client.secrets.kv.v2.read_secret_version(
+            mount_point='kv',
             path='service/github/neoloc/tokens/read-only-token'
         )
         github_token = github_secret['data']['data']['token']
@@ -95,6 +99,7 @@ def get_api_tokens() -> Tuple[str, str]:
     # Read Gitea token
     try:
         gitea_secret = client.secrets.kv.v2.read_secret_version(
+            mount_point='kv',
             path='service/gitea/unkinben/tokens/read-only-packages'
         )
         gitea_token = gitea_secret['data']['data']['token']

tools/update-gh

@@ -47,8 +47,11 @@ def get_vault_client() -> hvac.Client:
         logger.error("VAULT_ROLE_ID environment variable is required")
         raise ValueError("VAULT_ROLE_ID environment variable is required")
 
-    # Initialize Vault client
+    # Initialize Vault client with CA certificate
-    client = hvac.Client(url=vault_addr)
+    client = hvac.Client(
+        url=vault_addr,
+        verify='/etc/pki/tls/cert.pem'
+    )
 
     # Authenticate using AppRole
     try:
@@ -84,6 +87,7 @@ def get_api_tokens() -> Tuple[str, str]:
     # Read GitHub token
     try:
         github_secret = client.secrets.kv.v2.read_secret_version(
+            mount_point='kv',
             path='service/github/neoloc/tokens/read-only-token'
         )
         github_token = github_secret['data']['data']['token']
@@ -95,6 +99,7 @@ def get_api_tokens() -> Tuple[str, str]:
     # Read Gitea token
     try:
         gitea_secret = client.secrets.kv.v2.read_secret_version(
+            mount_point='kv',
             path='service/gitea/unkinben/tokens/read-only-packages'
         )
         gitea_token = gitea_secret['data']['data']['token']