flock M1 scaffold: CNI plugin + agent + NodeConfig CRD

- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
  ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
  parent fsync); pending/committed lifecycle. Tests cover round-trip,
  replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
  nibble distribution table from the design doc, determinism, prefix
  preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
  pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
  nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
  code.fritzlab.net/fritzlab/flock; runs go test in CI.

Design doc: dfritzlab/k8s-manager/dfritz-cni.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/main.yaml

@@ -0,0 +1,60 @@
+name: Build flock Image
+on:
+  push:
+    branches: [main]
+jobs:
+  build:
+    runs-on: fritzlab
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v4
+
+      - name: Run unit tests
+        run: |
+          docker run --rm -v "$PWD:/src" -w /src golang:1.26-alpine \
+            sh -c "go test ./..."
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: code.fritzlab.net
+          username: ci-bot
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: code.fritzlab.net/fritzlab/flock
+          tags: |
+            type=raw,value=latest
+            type=raw,value=${{ github.run_number }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          provenance: false
+          build-args: |
+            GIT_SHA=${{ github.sha }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          network: host
+
+      - name: Smoke-test image
+        run: |
+          docker run --rm code.fritzlab.net/fritzlab/flock:${{ github.run_number }} --help || true
+          docker run --rm --entrypoint /usr/local/bin/flock \
+            code.fritzlab.net/fritzlab/flock:${{ github.run_number }} || true
+
+      - name: Clean up old image tags
+        run: |
+          tea login add --name ci --url https://code.fritzlab.net --token '${{ secrets.CI_BOT_TOKEN }}' --no-version-check
+          tea api '/packages/fritzlab?type=container' \
+            | jq -r '.[] | select(.name=="flock") | select(.version | test("^[0-9]+$")) | .version' \
+            | sort -n | head -n -3 \
+            | while read tag; do
+                echo "deleting flock:$tag"
+                tea api -X DELETE "/packages/fritzlab/container/flock/$tag"
+              done