flock M1 scaffold: CNI plugin + agent + NodeConfig CRD

- cmd/flock + cmd/flock-agent: build cleanly; CNI ADD/DEL/CHECK return
  ErrInternal stubs until M2; agent boots, opens unix socket, logs JSON.
- pkg/agent/state.go: durable allocations.json (atomic write + fsync +
  parent fsync); pending/committed lifecycle. Tests cover round-trip,
  replace-by-cid, version mismatch, no-leak-on-tmp.
- pkg/embed/suffix.go: ip-algo IID embedding. Tests cover the /48-/96
  nibble distribution table from the design doc, determinism, prefix
  preservation, N-nibble isolation, digest-vs-fallback divergence.
- pkg/api/v1alpha1: minimal NodeConfig types (no controller-runtime yet).
- deploy/: NodeConfig CRD, empty ServiceAccount/ClusterRole, DaemonSet
  pinned to flock.fritzlab.net/agent="" label so it only runs on opted-in
  nodes.
- .gitea/workflows/main.yaml + Dockerfile: build + push to
  code.fritzlab.net/fritzlab/flock; runs go test in CI.

Design doc: dfritzlab/k8s-manager/dfritz-cni.md.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/cni/plugin.go

@@ -0,0 +1,37 @@
+// Package cni hosts the CNI plugin entry-points. The plugin binary is short-
+// lived: it is invoked by kubelet, talks to flock-agent over a unix socket,
+// and exits. All real work happens in the agent.
+package cni
+
+import (
+	"errors"
+
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/types"
+	current "github.com/containernetworking/cni/pkg/types/100"
+)
+
+// SocketPath is the unix socket exposed by flock-agent.
+const SocketPath = "/run/flock/flock.sock"
+
+var errNotImplemented = errors.New("flock: ADD/DEL/CHECK not implemented in M1 scaffold")
+
+// CmdAdd is invoked by kubelet when a pod sandbox is created.
+func CmdAdd(args *skel.CmdArgs) error {
+	// M2: dial SocketPath, send ADD RPC, return CNI result.
+	_ = args
+	_ = current.ImplementedSpecVersion
+	return types.NewError(types.ErrInternal, "flock-add", errNotImplemented.Error())
+}
+
+// CmdDel is invoked by kubelet when a pod sandbox is torn down.
+func CmdDel(args *skel.CmdArgs) error {
+	_ = args
+	return types.NewError(types.ErrInternal, "flock-del", errNotImplemented.Error())
+}
+
+// CmdCheck verifies that the live netns matches the persisted allocation.
+func CmdCheck(args *skel.CmdArgs) error {
+	_ = args
+	return types.NewError(types.ErrInternal, "flock-check", errNotImplemented.Error())
+}