feat(netbox): add image bundling netbox-opennms-plugin

[indigo423]

Summary

Adds a new netbox/ image project that layers our netbox-opennms-plugin onto the official netboxcommunity/netbox image. Follows the repo's project contract (Dockerfile.tpl + version-lock.sh + release.tag + one-line Makefile), so CI discovers and builds it automatically — no workflow changes.

Design (from OpenSpec add-netbox-opennms-image)

• Pip-only scope — the plugin is bundled into /opt/netbox/venv but not activated. PLUGINS/PLUGINS_CONFIG (incl. OpenNMS URL/credentials) are supplied at deploy time, keeping the image reusable and secret-free. This is the maintainer-recommended pattern from netbox-chart#173.
• Pinned versions — base netboxcommunity/netbox:v4.6.4; plugin git tag v0.0.2 (no PyPI release yet). Published tag mirrors the NetBox version: netbox:4.6.4.
• git-in-image — the NetBox runtime image ships no git, so a throwaway build stage adds it, installs the plugin with the image's own uv, and the populated venv is copied into a clean final image (no git/apt in the published artifact).
• Renovate — two customManagers track the NetBox base tag and the plugin git tag.

Verification (local)

• ✅ import netbox_opennms → OK, v0.0.2
• ✅ deps present → requests 2.34.2, lxml 6.1.1
• ✅ plugin ships only templates/ (runtime-loaded), no static/ → collectstatic not needed
• ✅ both linux/amd64 + linux/arm64 build cleanly
• ✅ shellcheck + hadolint pass on the new files

Follow-ups (not in this PR)

• quay.io: a netbox repository with Write for the CI robot is required before the first main publish (else 401), same as the recent per-repo permission fixes.
• Renovate coverage for other projects' literal (non-base_images.sh) base images (gobgp, retro-aim-server, robotframework, pleroma) could be generalized in a separate change.
• Dependency-drift hardening (constraints on the plugin install) is a latent consideration; current v0.0.2 install upgrades none of NetBox's pinned deps.

🤖 Generated with Claude Code