Add SPDDK build

scripts/extract-artifacts.sh

@@ -18,6 +18,11 @@ OUT=${2:?usage: extract-artifacts.sh <qcow2> <output-dir> [disable_dot1x]}
 # TEMPORARY test toggle: when "true", bake rd.dot1x=0 into the cmdline so the
 # UKI boots with 802.1X + MACsec disabled (open-port NVMe-oF boot test).
 DISABLE_DOT1X=${3:-false}
+# NVMe/TCP discovery address baked into the (immutable, signed) UKI cmdline.
+# Prefer a per-environment DNS name resolved at boot so one UKI works across
+# environments. Defaults to the literal placeholder so build-oci.sh's warning
+# fires if it was never set.
+NVMET_TRADDR=${NVMET_TRADDR:-NVMET_TRADDR}
 
 for bin in virt-copy-out virt-tar-out virt-ls mkfs.erofs veritysetup jq; do
     command -v "$bin" >/dev/null || { echo "ERROR: $bin not found on build host" >&2; exit 1; }
@@ -83,7 +88,7 @@ printf '%s' \
   "$DOT1X_FRAGMENT" \
   "rd.neednet=1 systemd.volatile=overlay " \
   "rd.dot1x.nvindex=0x01800001 rd.dot1x.timeout=60 " \
-  "rd.nvmf.discover=tcp,NVMET_TRADDR,4420 " \
+  "rd.nvmf.discover=tcp,${NVMET_TRADDR},4420 " \
   "root=/dev/mapper/root rootfstype=erofs rootflags=ro " \
   "systemd.verity=yes roothash=${ROOT_HASH} " \
   "systemd.verity_root_data=/dev/nvme0n1 " \