Populate terragrunt-enc: encapi ENC data as code

terragrunt-enc is the single source of truth for encapi ENC data (Puppet
statuses, roles, and node classifications), managed with Terraform/Terragrunt.
It supersedes Cobbler classification for Puppet and the terraform-incus
dual-write prototype (PR #39).

- Add modules/encapi (encapi_status / encapi_role / encapi_node, nodes
  FK-ordered after their role and status).
- Add config/encapi leaf: 3 statuses, 51 roles, and 143 node assignments
  (130 container VMs env production + 13 prodnxsr physicals env develop),
  all YAML-driven.
- Add config/root.hcl (consul backend infra/terraform/enc/<leaf>/state) and
  the encapi provider from the artifactapi registry (v0.1.0).
- Add Makefile, Woodpecker pre-commit/plan/apply pipelines, pre-commit
  config, ci/extract_incus_nodes.py, and expand the README.

README.md

@@ -1,3 +1,60 @@
 # terragrunt-enc
 
-Single source of truth for encapi ENC data (statuses, roles, nodes), managed via Terraform/Terragrunt. Supersedes Cobbler node classification for Puppet.
+Single source of truth for [encapi](https://git.unkin.net/unkin/encapi) ENC
+data, managed with Terraform/Terragrunt. This repo owns every Puppet node
+classification the estate has:
+
+- **statuses** — Puppet environments (`production`, `develop`, `testing`)
+- **roles** — the Puppet role classes (`roles::…`) a node can be assigned
+- **nodes** — the certname → role + environment mapping for all 143 hosts
+  (130 container VMs + 13 `prodnxsr*` physicals)
+
+It **supersedes Cobbler** as the classification source for Puppet: encapi is the
+live ENC, and this repo is the declarative, reviewed input to it. It also
+supersedes the dual-write approach that was prototyped in terraform-incus
+(PR #39) — terraform-incus is no longer involved in ENC data.
+
+## Layout
+
+```
+config/
+  root.hcl              # terragrunt root: consul backend (infra/terraform/enc/<leaf>/state)
+  encapi/
+    terragrunt.hcl      # leaf: feeds the three YAMLs into modules/encapi
+    statuses.yaml       # Puppet environments
+    roles.yaml          # Puppet role classes
+    nodes.yaml          # certname -> {role, environment} for all 143 hosts
+modules/
+  encapi/               # encapi_status / encapi_role / encapi_node resources,
+                        # ordered so nodes depend on their role + status (FK)
+ci/
+  extract_incus_nodes.py  # regenerates the container-VM block of nodes.yaml
+                          # from a terraform-incus checkout
+```
+
+The encapi provider comes from the internal registry
+(`artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi` v0.1.0). Writes to
+encapi are authenticated with `ENCAPI_WRITE_TOKEN`, read from Vault by the
+Makefile.
+
+## Data provenance
+
+- **130 container VMs** (`environment: production`) are extracted from
+  terraform-incus `config/instances/<host>/config.yaml`: certname is
+  `<host>.main.unkin.net`, role is `cobbler_mgmt_classes[0]` (default
+  `roles::base`). terraform-incus itself is not modified — the data is copied in
+  here as plain config. Re-run `ci/extract_incus_nodes.py --incus-repo <path>`
+  to refresh after VM changes.
+- **13 `prodnxsr*` physical nodes** (`environment: develop`) are the bare-metal
+  hypervisor / k8s nodes, not managed by the incus module. Their roles come from
+  the PuppetDB `enc_role` fact and are maintained by hand in `nodes.yaml`.
+
+## Usage
+
+CI (Woodpecker) plans on every PR and applies on merge to `main`, authenticating
+to Vault via kubernetes auth (`terraform-enc` ServiceAccount). Locally:
+
+```sh
+make plan    # approle auth by default (needs env with VAULT_ROLEID)
+make apply
+```