refactor(pack): template custom mod metadata so BASE_DOMAIN isn't frozen

The download URL is the only domain-dependent field in the external-file
metadata. Make mods/*.pw.toml build output rendered from committed
mods/*.pw.toml.tmpl (url uses ${BASE_DOMAIN}); render-config.sh and
add-custom-mod.sh render them + packwiz refresh at deploy/add time.

- pack/.packwizignore: keep *.pw.toml.tmpl out of the index
- gitignore rendered pack/mods/*.pw.toml + pack/index.toml (build output)
- seed a minimal index.toml before refresh (packwiz won't bootstrap one)
- add-custom-mod renders inline (BASE_DOMAIN only) — no coupling to
  dnsmasq's HOST_LAN_IP

Domain changes now just need a re-render, not a metadata rewrite.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tooling/render-config.sh

@@ -19,3 +19,19 @@ render() {  # $1=template  $2=output
 
 render drasl/config/config.toml.tmpl drasl/config/config.toml
 render dnsmasq/dnsmasq.conf.tmpl      dnsmasq/dnsmasq.conf
+
+# packwiz external-file metadata: render every pack/mods/*.pw.toml.tmpl into its
+# .pw.toml (injects ${BASE_DOMAIN} into the download URL), then rebuild the
+# packwiz index. .packwizignore keeps the .tmpl out of the index.
+shopt -s nullglob
+tmpls=(pack/mods/*.pw.toml.tmpl)
+shopt -u nullglob
+if [ "${#tmpls[@]}" -gt 0 ]; then
+  for t in "${tmpls[@]}"; do render "$t" "${t%.tmpl}"; done
+  command -v packwiz >/dev/null 2>&1 || { echo "packwiz not found — cannot refresh index" >&2; exit 1; }
+  # index.toml is gitignored build output; seed a minimal one so packwiz refresh
+  # (which won't bootstrap a missing index) has something to populate.
+  [ -f pack/index.toml ] || printf 'hash-format = "sha256"\n' > pack/index.toml
+  ( cd pack && packwiz refresh )
+  echo "refreshed packwiz index (${#tmpls[@]} external metafiles)"
+fi