flock M1 scaffold: CNI plugin + agent + NodeConfig CRD

- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
  ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
  parent fsync); pending/committed lifecycle. Tests cover round-trip,
  replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
  nibble distribution table from the design doc, determinism, prefix
  preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
  pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
  nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
  code.fritzlab.net/fritzlab/flock; runs go test in CI.

Design doc: dfritzlab/k8s-manager/dfritz-cni.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

deploy/crds/flock.fritzlab.net_nodeconfigs.yaml

@@ -0,0 +1,72 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: nodeconfigs.flock.fritzlab.net
+spec:
+  group: flock.fritzlab.net
+  scope: Cluster
+  names:
+    kind: NodeConfig
+    listKind: NodeConfigList
+    singular: nodeconfig
+    plural: nodeconfigs
+    shortNames:
+      - fnc
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          required: [spec]
+          properties:
+            spec:
+              type: object
+              required: [bgp]
+              properties:
+                cidr6:
+                  type: array
+                  items:
+                    type: string
+                    description: IPv6 CIDR owned and aggregate-advertised by this node.
+                cidr4:
+                  type: array
+                  items:
+                    type: string
+                    description: IPv4 CIDR owned and aggregate-advertised by this node.
+                bgp:
+                  type: object
+                  required: [asn, peers]
+                  properties:
+                    asn:
+                      type: integer
+                      format: int64
+                      minimum: 1
+                      maximum: 4294967295
+                      description: This node's local ASN.
+                    peers:
+                      type: array
+                      minItems: 1
+                      items:
+                        type: object
+                        required: [address, asn]
+                        properties:
+                          address:
+                            type: string
+                            description: Peer IP (IPv6 or IPv4).
+                          asn:
+                            type: integer
+                            format: int64
+                            minimum: 1
+                            maximum: 4294967295
+      additionalPrinterColumns:
+        - name: ASN
+          type: integer
+          jsonPath: .spec.bgp.asn
+        - name: CIDR6
+          type: string
+          jsonPath: .spec.cidr6
+        - name: CIDR4
+          type: string
+          jsonPath: .spec.cidr4