Add release machinery: version bump, nfpm RPM, release-on-tag pipeline

- Makefile: add make patch|minor|major (tag + push), dist-build, completions,
  and rpm/rpm-package targets.
- packaging/nfpm.yaml + scripts/build-rpm.sh: package the tomswall binary with
  bash/zsh completions, the example config, and a systemd agent unit into an RPM.
- packaging/tomswall-agent.service + agent.env: run `tomswall agent` as a
  systemd service (CAP_NET_ADMIN/CAP_NET_RAW), configured via /etc/tomswall/agent.env.
- .woodpecker/release.yaml: on v* tag, test -> build -> package RPM -> PUT to the
  artifactapi rpm-internal repo. Matches node-lookup conventions.

packaging/nfpm.yaml

@@ -0,0 +1,58 @@
+---
+# nfpm config for building the tomswall RPM.
+# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - tomswall
+provides:
+  - tomswall
+
+contents:
+  - src: dist/tomswall
+    dst: /usr/sbin/tomswall
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+  # Example configuration (never overwrites an existing tomswall.yaml).
+  - src: tomswall.example.yaml
+    dst: /etc/tomswall/tomswall.example.yaml
+    file_info:
+      mode: 0644
+
+  # systemd unit + environment file for the control-plane agent.
+  - src: packaging/tomswall-agent.service
+    dst: /usr/lib/systemd/system/tomswall-agent.service
+    file_info:
+      mode: 0644
+  - src: packaging/tomswall-agent.env
+    dst: /etc/tomswall/agent.env
+    type: config|noreplace
+    file_info:
+      mode: 0640
+
+  # Shell completions (generated by scripts/build-rpm.sh before packaging).
+  - src: dist/completions/tomswall.bash
+    dst: /usr/share/bash-completion/completions/tomswall
+    file_info:
+      mode: 0644
+  - src: dist/completions/_tomswall
+    dst: /usr/share/zsh/site-functions/_tomswall
+    file_info:
+      mode: 0644

packaging/tomswall-agent.env

@@ -0,0 +1,12 @@
+# Environment for the tomswall control-plane agent (tomswall-agent.service).
+# The agent reads these; flags may also be passed via ExecStart.
+
+# Base URL of the tomswallapi control plane.
+TOMSWALL_API_URL=https://tomswallapi.k8s.syd1.au.unkin.net
+
+# Agent bearer token (issued by the control plane / Vault). Keep this file 0640.
+TOMSWALL_AGENT_TOKEN=
+
+# The device name defaults to the system hostname. To override it, add
+# `--device <name>` to ExecStart in the unit (drop-in), e.g.:
+#   ExecStart=/usr/sbin/tomswall agent --device fw-a

packaging/tomswall-agent.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=tomswall control-plane agent (pull and apply firewall config)
+Documentation=https://git.unkin.net/unkin/tomswall
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/tomswall/agent.env
+ExecStart=/usr/sbin/tomswall agent
+Restart=on-failure
+RestartSec=10
+# The agent programs nftables and needs the requisite capabilities.
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+
+[Install]
+WantedBy=multi-user.target