Initial commit: full Phases 1-6 implementation

Post-repair hardware validation pipeline for Proxmox cluster hosts.
Go orchestrator + in-image agent + mkosi live image + bundled dnsmasq
PXE + SQLite + HTMX/SSE UI + notify registry + janitor + full docs.

cmd/vetting-agent/main.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"vetting/agent"
+	"vetting/agent/bootstate"
+)
+
+func main() {
+	cmdlinePath := flag.String("cmdline", "/proc/cmdline", "path to kernel cmdline (override for local testing)")
+	flag.Parse()
+
+	p, err := bootstate.ParseCmdline(*cmdlinePath)
+	if err != nil {
+		log.Fatalf("bootstate: %v", err)
+	}
+	log.Printf("vetting-agent starting: run=%d mac=%s orchestrator=%s", p.RunID, p.MAC, p.OrchestratorURL)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, os.Interrupt, syscall.SIGTERM)
+	go func() {
+		<-sig
+		log.Printf("vetting-agent: signal received, shutting down")
+		cancel()
+	}()
+
+	if err := agent.Run(ctx, p); err != nil && err != context.Canceled {
+		log.Fatalf("agent: %v", err)
+	}
+}