feat: add distribution and fleet management — CI/CD, OCI, metrics, ARM64 (Phase 5)

- Gitea Actions CI pipeline: Go tests, build, shellcheck on push/PR
- Gitea Actions release pipeline: full build + artifact upload on version tags
- OCI container image builder for registry-based OS distribution
- Zero-dependency Prometheus metrics endpoint (kubesolo_os_info, boot,
  memory, update status) with 10 tests
- USB provisioning tool for air-gapped deployments with cloud-init injection
- ARM64 cross-compilation support (TARGET_ARCH env var + build-cross.sh)
- Updated build scripts to accept TARGET_ARCH for both amd64 and arm64
- New Makefile targets: oci-image, build-cross

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -0,0 +1,91 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test-go:
+    name: Go Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Test cloud-init
+        run: cd cloud-init && go test ./... -v -count=1
+
+      - name: Test update agent
+        run: cd update && go test ./... -v -count=1
+
+      - name: Vet cloud-init
+        run: cd cloud-init && go vet ./...
+
+      - name: Vet update agent
+        run: cd update && go vet ./...
+
+  build-binaries:
+    name: Build Go Binaries
+    runs-on: ubuntu-latest
+    needs: test-go
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+            suffix: linux-amd64
+          - goos: linux
+            goarch: arm64
+            suffix: linux-arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Build cloud-init (${{ matrix.suffix }})
+        run: |
+          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -ldflags='-s -w' -o kubesolo-cloudinit-${{ matrix.suffix }} ./cmd/
+        working-directory: cloud-init
+
+      - name: Build update agent (${{ matrix.suffix }})
+        run: |
+          CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -ldflags='-s -w' -o kubesolo-update-${{ matrix.suffix }} .
+        working-directory: update
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: binaries-${{ matrix.suffix }}
+          path: |
+            cloud-init/kubesolo-cloudinit-${{ matrix.suffix }}
+            update/kubesolo-update-${{ matrix.suffix }}
+
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+      - name: Lint init scripts (POSIX sh)
+        run: shellcheck -s sh init/init.sh init/lib/*.sh init/emergency-shell.sh
+
+      - name: Lint build scripts (bash)
+        run: shellcheck -s bash build/scripts/*.sh build/config/kernel-audit.sh
+
+      - name: Lint test scripts (bash)
+        run: shellcheck -s bash test/qemu/*.sh test/integration/*.sh test/kernel/*.sh || true
+
+      - name: Lint hack scripts (bash)
+        run: shellcheck -s bash hack/*.sh || true