[navaneeth-dev]

Adds bootcmd and runcmd support, so a Cluster API worker cloud-config can run its pre-kubeadm commands, kubeadm join, and post-kubeadm commands on Flatcar.

• Only the shape Cluster API emits is accepted: a list of strings. Argument lists, non-strings, and a null stanza are rejected with path-aware errors.
• Each stanza becomes a verbatim #!/bin/sh script at /opt/butane-init/<stanza>.sh (root, mode 0700) without set -e, matching cloud-init. A failing command does not stop later ones.
• Scripts live in /opt, not /etc, because Flatcar 4757 mounts /etc as a noexec confext overlay.
• bootcmd runs every boot through butane-init-bootcmd.service, after network.target and before network-online.target and runcmd. If it fails, runcmd still runs.
• runcmd runs once per instance through butane-init-runcmd.service, after network-online.target. An instance is the Flatcar machine ID. The marker /var/lib/butane-init/sem/<machine-id>/runcmd is written before the commands run, so failed or interrupted runs are not retried, and flatcar-reset causes a rerun.
• The units, and nothing else, get PATH with /opt/butane-init/bin:/opt/bin first, HOME=/root, and INSTANCE_ID=%m.
• The two units and the cloud-init-per replacement are plain files under commands/, embedded with //go:embed; a test keeps every path they use reserved against write_files.
• A generated cloud-init-per replacement (once|instance|always) is provided because Flatcar has no cloud-init. Commands are never rewritten, and no other cloud-init tools are provided.
• Caveat: write_files content already exists when bootcmd runs, unlike cloud-init's first boot.
• Caveat: output goes to the journal only; /var/log/cloud-init-output.log is not emulated.
• Caveat: units have no start timeout, so a hanging command delays multi-user.target indefinitely.
• /opt/butane-init, /var/lib/butane-init, the unit files and drop-in directories, their multi-user.target.wants symlinks, and Ignition's preset file are reserved, and write_files entries that target them are rejected. An oracle review found that the preset file and symlinks could otherwise disable the units.
• Verified with Go tests, butane --strict, and a Flatcar 4757.2.1 QEMU boot plus reboot. The checks covered: unit ordering, the environment, no set -e, the Cluster API sentinel, runcmd skipped after a failed first run, bootcmd rerunning on every boot, and the cloud-init-per markers.
• flatcar-reset --keep-paths /var/lib/butane-init was also tested: with a new machine ID, runcmd and cloud-init-per instance ran again, while cloud-init-per once did not. A reset without kept paths wipes the markers, so everything runs again.
• cloud-init-per passes shellcheck -s sh.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.