flock M1 scaffold: CNI plugin + agent + NodeConfig CRD

- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
  ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
  parent fsync); pending/committed lifecycle. Tests cover round-trip,
  replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
  nibble distribution table from the design doc, determinism, prefix
  preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
  pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
  nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
  code.fritzlab.net/fritzlab/flock; runs go test in CI.

Design doc: dfritzlab/k8s-manager/dfritz-cni.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/api/v1alpha1/groupversion_info.go

@@ -0,0 +1,8 @@
+// Package v1alpha1 contains API Schema definitions for the flock.fritzlab.net
+// v1alpha1 API group.
+package v1alpha1
+
+const (
+	GroupName = "flock.fritzlab.net"
+	Version   = "v1alpha1"
+)

pkg/api/v1alpha1/nodeconfig_types.go

@@ -0,0 +1,54 @@
+package v1alpha1
+
+// NodeConfigSpec is the operator-written desired state for a single node.
+//
+// The agent reads this on startup and via informer for live updates. There is
+// no controller and no auto-allocation — purely declarative input.
+type NodeConfigSpec struct {
+	// CIDR6 is the set of IPv6 CIDRs this node owns and advertises as BGP
+	// aggregates. Pod IPv6 addresses are allocated from these.
+	CIDR6 []string `json:"cidr6,omitempty"`
+
+	// CIDR4 is the set of IPv4 CIDRs this node owns and advertises as BGP
+	// aggregates. Pod IPv4 addresses are allocated from these.
+	CIDR4 []string `json:"cidr4,omitempty"`
+
+	// BGP configures the BGP sessions this node establishes upstream.
+	BGP BGPSpec `json:"bgp"`
+}
+
+type BGPSpec struct {
+	// ASN is this node's local autonomous system number.
+	ASN uint32 `json:"asn"`
+
+	// Peers lists upstream BGP peers (typically the rack/site router).
+	Peers []BGPPeer `json:"peers"`
+}
+
+type BGPPeer struct {
+	// Address is the peer's IP (IPv6 or IPv4).
+	Address string `json:"address"`
+	// ASN is the peer's autonomous system number.
+	ASN uint32 `json:"asn"`
+}
+
+// NodeConfig is the Schema for the nodeconfigs API.
+type NodeConfig struct {
+	TypeMeta   `json:",inline"`
+	ObjectMeta `json:"metadata,omitempty"`
+
+	Spec NodeConfigSpec `json:"spec,omitempty"`
+}
+
+// TypeMeta and ObjectMeta are minimal stand-ins so this package can be used
+// without dragging in k8s.io/apimachinery during the M1 scaffold. They will be
+// replaced by metav1.TypeMeta / metav1.ObjectMeta when the agent wires up
+// controller-runtime in M2.
+type TypeMeta struct {
+	Kind       string `json:"kind,omitempty"`
+	APIVersion string `json:"apiVersion,omitempty"`
+}
+
+type ObjectMeta struct {
+	Name string `json:"name,omitempty"`
+}