If it becomes necessary, make skip-files file values default to
basenames but permit full paths to resolve ambiguities.

(1.7a) Add ipv6-prefix rewrite case for longer prefixes within
the delegation.

(1.7) Add _custom_ipv6_prefix and ipv6-prefix custom type.
Supports same-size changes for /56 and /60, and will do
its best to do a /56 to /60 change with orphaned address
detection.

(1.6a) Add optional custom-var ipv6-type to _custom_ip_address (default
is "tunnel", used only in output messages.  Refactor _custom_ip_address
into _custom_substitute_files for the main engine and _custom_ip_address
for the input collection and validation, in preparation to add another
custom type for IPv6 prefix delegation changes.

(1.6) Add custom-vars require-source-dir and skip-files to
_custom_ip_address (ip-address). This allows for different
hosts to receive different config files and to not run if
a required source dir is missing (e.g., pulling file configs
to change from a backup that is offline). Change rsync path
for Linux or macOS (though this is still untested off-OpenBSD).

(1.5) Allow distribute.pl to distribute to the host it's run on.

(1.4) Fix bugs identified by Claude Opus 4.8 review
    fixed new-IP-address range validation, %s->%S timestamp, add_files
    partial-failure check, passphrase/temp cleanup via END block, OpenBSD
    version-parse fallback, and regex metachar quoting
    (host/$INSTALL_DIR, pkg_start).

(1.3) Add syslock grp files for packages when required.

(1.2a): Make second signature verification also fail fast.

(1.2): Collect error codes from rsync calls and report failed hosts
at the end.  (gendoas 1.4: wrap pledge/unveil with conditional to only execute
on OpenBSD).

distribute: Changed name of $vv to $v_epoch (DONE)

Add a -h option to distribute to specify that a subset of the hosts
will get the files. -h would take either a single host name or a
comma-separated list; if any hosts in the list aren't identified
in the config as a recipient for a particular file specified, those
hosts don't get it (and perhaps print a warning to that effect, maybe
with a -v option). (DONE)

Add a -d debug option to print more processing information. (DONE)

Split into part that either runs as root or uses doas to get the files
to copy (though the vast majority are world readable), and runs non-priv
to do the building, signing, and distribution.
