feat!: migrate pulledpork to custom resources

[damacus]

Summary

• Selected cookbook: pulledpork.
• Migrated the legacy recipe and attribute API into pulledpork_install, pulledpork_config, and pulledpork_cron custom resources.
• Removed root recipes/ and attributes/ for the Full Migration scope.
• Added resource docs, migration.md, LIMITATIONS.md, step-into ChefSpec coverage, a modern test cookbook, and a default InSpec profile.
• Updated Kitchen/CI to current non-EOL tested platforms and Cinc Workstation install.

Platform and support evidence

• PulledPork is source-distributed from shirkdog/pulledpork; the repository is not archived, with latest observed push 2021-07-07.
• The active sous-chefs/snort cookbook remains available for wrapper cookbooks that need full Snort installation.
• Kept support to current package-backed Linux families: Debian 12, Ubuntu 22.04/24.04, Amazon Linux 2023, Enterprise Linux 8/9 derivatives, Fedora latest, and CentOS Stream 9.
• Removed EOL/stale test targets from the matrix: CentOS 6/7, CentOS Stream 8, Debian 8/9/10/11, Oracle Linux 7, Ubuntu 16.04/18.04/20.04/23.04, and unsupported SUSE drift.

Workflow permission sources checked

• sous-chefs/.github@6.0.0 .github/workflows/lint-unit.yml: caller keeps checks: write, pull-requests: write, and statuses: write for metadata reporting.
• sous-chefs/.github@6.0.0 .github/workflows/prevent-file-change.yml: caller adds pull-requests: write.
• sous-chefs/.github@6.0.0 .github/workflows/conventional-commits.yml: caller adds pull-requests: read.
• sous-chefs/.github@6.0.0 .github/workflows/release-cookbook.yml: release workflow passes all required secrets.
• sous-chefs/.github@6.0.0 .github/actions/install-workstation/action.yml: CI uses the pinned Cinc Workstation action.
• googleapis/release-please-action@v4 README: release workflow keeps contents: write, issues: write, and pull-requests: write.
• actions/attest-build-provenance@v4/action.yml and nested actions/attest@v4.1.0: release workflow keeps attestations: write and id-token: write.
• actions/upload-artifact@v7/action.yml: no extra caller permission beyond release workflow needs was identified.

Verification

• berks install exited 0 and resolved pulledpork, local test, ark, and seven_zip.
• cookstyle: 14 files inspected, no offenses detected.
• chef exec rspec --format documentation: 27 examples, 0 failures.
• KITCHEN_LOCAL_YAML=kitchen.dokken.yml kitchen test default-ubuntu-2404 --destroy=always: passed; second converge was idempotent with 0/26 resources updated; InSpec reported 3 controls and 7 tests successful.
• markdownlint-cli2 "**/*.md": 0 errors.
• yamllint ., actionlint, and git diff --check: passed.
• Final structural audit passed: root recipes/ and attributes/ are absent.

[github-actions]

Slowest examples

Top 10 slowest examples (0.88 seconds, 46.77% of total time)

Example	Description	Time in seconds
spec/unit/resources/install_spec.rb:14	pulledpork_install with default properties is expected to install package "["libcrypt-ssleay-perl", "liblwp-useragent-determined-perl"]"	0.15836
spec/unit/resources/config_spec.rb:23	pulledpork_config with default properties is expected to nothing execute "run_pulledpork"	0.13784
spec/unit/resources/config_spec.rb:18	pulledpork_config with default properties is expected to create directory "/etc/snort"	0.08483
spec/unit/resources/config_spec.rb:34	pulledpork_config with default properties is expected to render file "/etc/snort/pulledpork.conf"	0.08348
spec/unit/resources/config_spec.rb:29	pulledpork_config with default properties is expected to render file "/etc/snort/pulledpork.conf"	0.07567
spec/unit/resources/config_spec.rb:39	pulledpork_config with default properties is expected to render file "/etc/snort/disablesid.conf"	0.07556
spec/unit/resources/config_spec.rb:50	pulledpork_config without disabled SIDs is expected not to create template "/etc/snort/disablesid.conf"	0.06798
spec/unit/resources/config_spec.rb:24	pulledpork_config with default properties is expected to create template "/etc/snort/disablesid.conf"	0.06731
spec/unit/resources/config_spec.rb:21	pulledpork_config with default properties is expected to create directory "/var/log/snort"	0.06723
spec/unit/resources/config_spec.rb:19	pulledpork_config with default properties is expected to create directory "/etc/snort/rules"	0.06685