Initial semaphore 2.19.8 package with service, container and postgresql subpackages

Semaphore UI packaged from the upstream community (MIT) release
binaries, following the gitea packaging pattern: native systemd service
and Podman quadlet variants (mutually exclusive), with an optional
PostgreSQL backend via quadlet drop-ins. SQLite is the default
database; session/encryption secrets are generated into
/etc/semaphore/env on first install.

README.md

@@ -0,0 +1,70 @@
+# semaphore
+
+Semaphore UI (https://semaphoreui.com) packaged for InfoMaOS. Web UI and
+API for running Ansible, Terraform, OpenTofu, Terragrunt, Bash and
+PowerShell tasks.
+
+Binaries are the upstream **community** (fully open source, MIT) release
+builds. Download the source tarballs with:
+
+    spectool -g semaphore.spec
+
+## Subpackages
+
+- `semaphore` — common base: `semaphore` user/group (uid/gid 127),
+  `/etc/semaphore/config.json`, `/etc/semaphore/env` (secrets generated
+  on first install), `/var/lib/semaphore` data directory.
+- `semaphore-service` — native binary + `semaphore.service` unit.
+  Requires `git` and `ansible`. Conflicts with `semaphore-container`.
+- `semaphore-container` — Podman quadlet running
+  `docker.io/semaphoreui/semaphore:v<version>` in a pod
+  (`semaphore-pod`, web UI published on port 3000). The image bundles
+  Ansible, Terraform, OpenTofu and Terragrunt. Conflicts with
+  `semaphore-service`.
+- `semaphore-postgresql` — optional PostgreSQL backend as a
+  `semaphore-db` quadlet container. With `-service` it runs standalone,
+  published on `127.0.0.1:5432`; with `-container` it joins the
+  semaphore pod. Without it, Semaphore uses SQLite at
+  `/var/lib/semaphore/database.sqlite` (zero configuration).
+
+## Database
+
+Default dialect is SQLite (`config.json`). Installing
+`semaphore-postgresql` switches the dialect to PostgreSQL via
+`SEMAPHORE_DB_*` environment drop-ins:
+
+- service mode: `/etc/systemd/system/semaphore.service.d/database.conf`
+- container mode: `/usr/share/containers/systemd/semaphore.container.d/database.conf`
+
+Change the default `semaphore`/`semaphore` credentials in **both** the
+relevant `database.conf` and
+`/etc/containers/systemd/semaphore-db.container.d/credentials.conf`
+before first start.
+
+## First start
+
+```bash
+systemctl enable --now semaphore.service   # service mode
+systemctl start semaphore.service          # container mode (enabled via pod drop-in)
+
+# Create the initial admin user
+semaphore user add --admin --login admin --name Admin \
+    --email admin@example.org --password '<password>' \
+    --config /etc/semaphore/config.json
+```
+
+In container mode `/usr/bin/semaphore` is a shim that runs the CLI
+inside the running container.
+
+Session/encryption secrets (`SEMAPHORE_COOKIE_HASH`,
+`SEMAPHORE_COOKIE_ENCRYPTION`, `SEMAPHORE_ACCESS_KEY_ENCRYPTION`) are
+generated into `/etc/semaphore/env` by the base package `%post` on first
+install. Back up this file — `SEMAPHORE_ACCESS_KEY_ENCRYPTION` encrypts
+the stored SSH keys and secrets, which are lost if it changes.
+
+## Updating
+
+1. Bump `Version` in the spec and the image tag in
+   `semaphore.container`.
+2. `spectool -g semaphore.spec`
+3. `./build.sh`