feat(labctl): add transformation hook support for image sync

[jmgilman]

Summary

• Add a new transform hook type that allows modifying files before upload
• Transform hooks receive a copy of the file and modify it in-place
• The transformed output becomes the upload source while checksum verification uses the input file (for caching)

Design choice: Implemented Option C (in-place modification) from the issue - simplest API for hook authors who just modify the file passed as the first argument.

Changes

• Schema: Added Transform field to Hooks struct with same validation as preUpload hooks
• Executor: Added RunTransformHooks() that creates a temp copy, runs hooks in sequence, returns transformed file path
• Sync: Transform hooks run after decompression, before preUpload hooks

Example Usage

images:
  - name: talos-um760
    source:
      url: https://factory.talos.dev/image/...
      checksum: sha256:abc123
    destination: talos/um760.iso
    hooks:
      transform:
        - name: embed-config
          command: ./scripts/embed-talos-config.sh
          args: ["--config", "machine.yaml"]
          timeout: 10m

Closes HOM-26

Test plan

• Unit tests for RunTransformHooks() covering:
  • No hooks returns empty result
  • Single hook modifies file in-place
  • Multiple hooks chain correctly
  • Hook failure returns error and cleans up temp files
  • Hook receives LABCTL_HOOK_CACHE environment variable
• Manifest validation tests for transform hooks
• Integration test verifying transformed content is uploaded
• All existing tests continue to pass (just all)

🤖 Generated with Claude Code

[linear]

HOM-26 Add transformation hook support to labctl