Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

agent/bootstate/state_test.go

@@ -0,0 +1,35 @@
+package bootstate
+
+import (
+	"testing"
+)
+
+func TestParseCmdlineGoldenPath(t *testing.T) {
+	s := `BOOT_IMAGE=vmlinuz initrd=initrd.img vetting.orchestrator=http://10.0.0.5:8080 vetting.run_id=42 vetting.mac=aa:bb:cc:dd:ee:ff vetting.token=deadbeefcafe vetting.cert_fpr=abc123 console=ttyS0,115200n8 quiet`
+	p, err := ParseCmdlineString(s)
+	if err != nil {
+		t.Fatalf("ParseCmdlineString: %v", err)
+	}
+	if p.OrchestratorURL != "http://10.0.0.5:8080" || p.RunID != 42 || p.MAC != "aa:bb:cc:dd:ee:ff" ||
+		p.Token != "deadbeefcafe" || p.TLSCertFPR != "abc123" {
+		t.Fatalf("parsed wrong: %+v", p)
+	}
+}
+
+func TestParseCmdlineMissingRequired(t *testing.T) {
+	s := `vetting.orchestrator=http://x vetting.mac=aa:bb:cc:dd:ee:ff vetting.token=t`
+	if _, err := ParseCmdlineString(s); err == nil {
+		t.Fatalf("expected error when vetting.run_id missing")
+	}
+}
+
+func TestParseCmdlineLowercasesMAC(t *testing.T) {
+	s := `vetting.orchestrator=http://x vetting.run_id=1 vetting.mac=AA:BB:CC:DD:EE:FF vetting.token=t`
+	p, err := ParseCmdlineString(s)
+	if err != nil {
+		t.Fatalf("ParseCmdlineString: %v", err)
+	}
+	if p.MAC != "aa:bb:cc:dd:ee:ff" {
+		t.Fatalf("MAC not lowercased: %q", p.MAC)
+	}
+}