Migrate CLI tools to Cobra for richer help and flag handling

Replace the stdlib flag package in both cmd/puppet-ca and
cmd/puppet-ca-ctl with github.com/spf13/cobra. The server becomes a
single root command with all flags declared via pflag; --cadir is now
enforced required by Cobra rather than a manual post-parse check.

The control CLI gains a proper subcommand tree with persistent global
flags (server-url, ca-cert, client-cert, client-key, verbose) that
work before or after the subcommand name. Required flags on each
subcommand (--certname, --cadir, etc.) are enforced by Cobra. The
fatalf/os.Exit pattern is replaced with error returns through RunE,
and checkHTTP now returns an error instead of exiting inline.

Replace the multi-stage in-container Go build with a slim runtime
image (Dockerfile.run) that COPYs pre-built binaries from bin/.
All integration test targets (integ, integCompose, loadCompose,
bench, stress) now depend on Build.All first, ensuring the local
binary is what gets tested. The original multi-stage Dockerfile is
kept for standalone docker-build use cases where Go is not installed
locally.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: trevor-vaughan

Dockerfile

@@ -30,10 +30,10 @@ COPY --from=builder /puppet-ca-ctl /usr/local/bin/puppet-ca-ctl
 USER puppet
 EXPOSE 8140
 
-# --cadir      : where CA state is stored
-# --autosign-config=true : sign all incoming CSRs immediately (dev/test only)
-# -v=1         : debug logging
+# --cadir             : where CA state is stored
+# --autosign-config   : sign all incoming CSRs immediately (dev/test only)
+# --verbosity         : debug logging
 ENTRYPOINT ["/usr/local/bin/puppet-ca"]
 CMD ["--cadir=/etc/puppetlabs/puppet/ssl/ca", \
      "--autosign-config=true", \
-     "-v=1"]
+     "--verbosity=1"]

Dockerfile.run

@@ -0,0 +1,31 @@
+# Runtime image built from locally-compiled binaries.
+#
+# Build the binaries first:
+#   mage build:all
+#   # or: go build -o bin/ ./cmd/...
+#
+# Then build this image:
+#   podman build -f Dockerfile.run -t puppet-ca:latest .
+#
+# Integration test targets (mage test:integ, test:integCompose, etc.) handle
+# both steps automatically.
+
+FROM quay.io/centos/centos:stream10
+
+# curl: health checks and agent CSR submission
+# openssl: CSR generation and cert verification in integration tests
+RUN dnf install -y curl openssl && dnf clean all && \
+    useradd -m puppet && \
+    mkdir -p /etc/puppetlabs/puppet/ssl/ca /data && \
+    chown -R puppet:puppet /etc/puppetlabs/puppet /data
+
+COPY bin/puppet-ca     /usr/local/bin/puppet-ca
+COPY bin/puppet-ca-ctl /usr/local/bin/puppet-ca-ctl
+
+USER puppet
+EXPOSE 8140
+
+ENTRYPOINT ["/usr/local/bin/puppet-ca"]
+CMD ["--cadir=/etc/puppetlabs/puppet/ssl/ca", \
+     "--autosign-config=true", \
+     "--verbosity=1"]

README.md

@@ -63,7 +63,7 @@ mage build:fips   # → bin/puppet-ca-fips  (GOEXPERIMENT=boringcrypto)
 | `--puppet-server` | `""` | Comma-separated CNs granted admin API access (mTLS only) |
 | `--daemon` | `false` | Fork to background (not recommended in containers) |
 | `--logfile` | `""` | Write JSON logs to this file instead of stderr |
-| `-v` | `0` | Verbosity: `0`=Info, `1`=Debug, `2`=Trace |
+| `--verbosity` / `-v` | `0` | Verbosity: `0`=Info, `1`=Debug, `2`=Trace |
 
 ### Quick start (plain HTTP, auto-bootstrap CA)
 
@@ -246,7 +246,7 @@ In plain HTTP mode (no TLS), all endpoints are accessible without authentication
 --verbose                               Enable debug logging
 ```
 
-Global flags must be placed **before** the subcommand name.
+Global flags may be placed before or after the subcommand name.
 
 ### Subcommands