Add on-tag RPM build (nfpm) and upload to artifactapi

Publish the plugin as an installable RPM so hosts can drop it into the Vault/
OpenBao plugin directory. On a tag, build the binary, package it with nfpm
(mirroring the rpmbuilder approach), and upload the RPM to artifactapi's local
rpm-internal repository.

- Add packaging/nfpm.yaml installing the binary to /opt/vault-plugins/ plus a
  preinstall script that creates the directory
- Add scripts/build-rpm.sh and make rpm / rpm-package targets
- Add .woodpecker/release.yml (event: tag): build -> nfpm package -> PUT to
  artifactapi remotes/rpm-internal/files/

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build install test lint fmt clean tidy e2e e2e-vault e2e-openbao e2e-up e2e-down patch minor major check-go
+.PHONY: build install test lint fmt clean tidy e2e e2e-vault e2e-openbao e2e-up e2e-down rpm rpm-package patch minor major check-go
 
 BINARY := vault-plugin-secrets-litellm
 PKG := ./cmd/vault-plugin-secrets-litellm
@@ -36,6 +36,13 @@ tidy:
 clean:
 	rm -rf $(PLUGIN_DIR)
 
+# Build the plugin binary then package it into an RPM with nfpm.
+rpm: build rpm-package
+
+# Package an already-built binary into an RPM (used by CI after the build step).
+rpm-package:
+	./scripts/build-rpm.sh $(VERSION)
+
 # End-to-end tests spin up LiteLLM + Postgres and both Vault and OpenBao in
 # Docker, then exercise the full lifecycle (configure, create role, generate,
 # use, revoke) against each engine using the same plugin binary.