Make all agent/node download endpoints configurable

[Copilot]

Follow-up to #70. The manual-bootstrap agent download was configurable, but machine register / machina-controller provisioning had no override surface, and the agent's own rootfs downloads (kubelet / containerd / runc / CNI / crictl) were hard-coded to upstream hosts - blocking air-gapped and mirrored deployments.

• Extend AgentSpec with optional Version / BaseURL / URL + Downloads block for Kubernetes / containerd / runc / CNI / crictl
• Factor ShellSingleQuote + AgentInstallEnv into internal/provision/shell.go
• Machina controller prepends POSIX-quoted AGENT_* env vars to install-script exec
• machine register + manual-bootstrap gain --agent-{version,base-url,url} + 15 --{kubernetes,containerd,runc,cni,crictl}-{base-url,url,version} flags
• Rootfs downloaders (rootfs/{kube,cri,cni}.go) honor overrides, preserving crictl Kubernetes-minor alignment
• Regenerate CRD + deepcopy
• Docs guide extended with an air-gapped end-to-end example
• Rebased onto latest main

[Jason Wilder (jwilder)]

Copilot rebase with latest main branch

[Copilot]

Copilot rebase with latest main branch

Rebased onto latest main in 532ed76. Net diff is unchanged and tests still pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 192.0.2.1
  • Triggering command: /tmp/go-build1653948396/b1187/controller.test /tmp/go-build1653948396/b1187/controller.test -test.testlogfile=/tmp/go-build1653948396/b1187/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1653948396/b1118/vet.cfg 489634/b1228/_pk-p mpile 0.1-go1.26.2.lin-lang=go1.25 -p /unbounded/inter-atomic mpile 0.1-go1.26.2.lin-buildtags -o 489634/b1292/exe-errorsas .cfg ux-amd64/pkg/tool/linux_amd64/vet /ops/wstrust/def/home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.2.linux-amd64/pkg/too/tmp/ccfwCtyp.o /ops/wstrust/def-atomic mpile ux-amd64/pkg/too-buildtags (packet block)
• invalid-ip
  • Triggering command: /tmp/go-build1653948396/b1187/controller.test /tmp/go-build1653948396/b1187/controller.test -test.testlogfile=/tmp/go-build1653948396/b1187/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1653948396/b1118/vet.cfg 489634/b1228/_pk-p mpile 0.1-go1.26.2.lin-lang=go1.25 -p /unbounded/inter-atomic mpile 0.1-go1.26.2.lin-buildtags -o 489634/b1292/exe-errorsas .cfg ux-amd64/pkg/tool/linux_amd64/vet /ops/wstrust/def/home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.2.linux-amd64/pkg/too/tmp/ccfwCtyp.o /ops/wstrust/def-atomic mpile ux-amd64/pkg/too-buildtags (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)