flock M1 scaffold: CNI plugin + agent + NodeConfig CRD

- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
  ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
  parent fsync); pending/committed lifecycle. Tests cover round-trip,
  replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
  nibble distribution table from the design doc, determinism, prefix
  preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
  pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
  nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
  code.fritzlab.net/fritzlab/flock; runs go test in CI.

Design doc: dfritzlab/k8s-manager/dfritz-cni.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,22 @@
+FROM golang:1.26-alpine AS build
+
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY cmd/    ./cmd/
+COPY pkg/    ./pkg/
+
+ARG GIT_SHA=unknown
+RUN CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.gitSHA=${GIT_SHA}" \
+        -o /out/flock ./cmd/flock \
+ && CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.gitSHA=${GIT_SHA}" \
+        -o /out/flock-agent ./cmd/flock-agent
+
+FROM alpine:3.21
+RUN apk add --no-cache iproute2 ca-certificates
+COPY --from=build /out/flock        /usr/local/bin/flock
+COPY --from=build /out/flock-agent  /usr/local/bin/flock-agent
+ENTRYPOINT ["/usr/local/bin/flock-agent"]