Add release machinery: version bump, nfpm RPM, release-on-tag pipeline

- Makefile: add make patch|minor|major (tag + push), dist-build, completions,
  and rpm/rpm-package targets.
- packaging/nfpm.yaml + scripts/build-rpm.sh: package the tomswall binary with
  bash/zsh completions, the example config, and a systemd agent unit into an RPM.
- packaging/tomswall-agent.service + agent.env: run `tomswall agent` as a
  systemd service (CAP_NET_ADMIN/CAP_NET_RAW), configured via /etc/tomswall/agent.env.
- .woodpecker/release.yaml: on v* tag, test -> build -> package RPM -> PUT to the
  artifactapi rpm-internal repo. Matches node-lookup conventions.

Makefile

@@ -1,12 +1,17 @@
-BINARY := tomswall
-MODULE := git.unkin.net/unkin/tomswall
-PREFIX := /usr/local
+BINARY  := tomswall
+MODULE  := git.unkin.net/unkin/tomswall
+PREFIX  := /usr/local
 CONFDIR := /etc/tomswall
+DIST    := dist
+VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
+OS      ?= $(shell go env GOOS)
+ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: build install clean check test
+.PHONY: build install clean check test fmt dist-build completions rpm rpm-package patch minor major _tag
 
 build:
-	go build -o $(BINARY) ./cmd/tomswall
+	go build $(GOFLAGS) -o $(BINARY) ./cmd/tomswall
 
 install: build
 	install -Dm755 $(BINARY) $(DESTDIR)$(PREFIX)/sbin/$(BINARY)
@@ -17,9 +22,54 @@ install: build
 
 clean:
 	rm -f $(BINARY)
+	rm -rf $(DIST)
 
 check:
 	go vet ./...
 
 test:
 	go test ./...
+
+fmt:
+	gofmt -w .
+
+# Build the binary into dist/ for the RPM packaging step.
+dist-build:
+	@mkdir -p $(DIST)
+	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) ./cmd/tomswall
+
+# Generate bash/zsh completions into dist/completions.
+completions: dist-build
+	@mkdir -p $(DIST)/completions
+	$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
+	$(DIST)/$(BINARY) completion zsh  > $(DIST)/completions/_$(BINARY)
+
+# Build the binary then package it (with completions) into an RPM via nfpm.
+rpm: dist-build rpm-package
+
+# Package an already-built dist/ binary into an RPM (used by CI after build).
+rpm-package:
+	./scripts/build-rpm.sh $(VERSION)
+
+# Bump helpers — read the latest semver tag and create+push the next one, which
+# triggers the release-on-tag pipeline. Starts from v0.0.0 when no tag exists.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
+
+_tag:
+	git push origin $(TAG)