Packer: native proxmox-clone builder + selectable qemu output (#1)

[michielvha]

Implements spec 0001 (docs/specs/0001-packer-proxmox-native-output.md). Closes #1.

What changed

One Ubuntu template, two builders sharing a single build block, selected at invocation:

• proxmox-clone.ubuntu — native Proxmox template. Clones a cloud-image base template, customizes it, attaches an empty cloud-init drive (cloud_init + cloud_init_storage_pool), authenticates with an API token, and ends flagged as a template. No per-build qm importdisk.
• qemu.ubuntu — portable qcow2, now arch-parameterized (amd64 default; arm64 for a fast HVF build on Apple Silicon).

Supporting changes:

• scripts/create-base-template.sh — Stage-0 one-time base-template bootstrap (cloud image + qemu-guest-agent → template).
• install.sh trimmed to generic (just waits for cloud-init); tooling deferred to Spec 0003: Move provisioning into PDS (select and apply) #3.
• cleanup.sh seals the image: cloud-init clean, machine-id + dbus reset, remove SSH host keys and the build authorized_keys.
• cloud-init seed stripped of identity (hostname vars) and amd64-only grub packages so it stays generic and arch-portable.
• Secrets: token via PKR_VAR_proxmox_api_token or an untracked *.auto.pkrvars.hcl (.example added); .gitignore covers outputs and real vars files.
• Removed orphaned scripts/.p10k.zsh + scripts/zshrc (zsh config returns via PDS in Spec 0003: Move provisioning into PDS (select and apply) #3).

Testing

• packer fmt -check — clean.
• packer validate — green for both builders (-only=qemu.ubuntu and the full template).
• packer build -only='qemu.ubuntu' — completed (5m29s, amd64 under TCG). Produced a sealed 922 MB qcow2; the build log confirms every generic-image step ran (machine-id truncate + dbus symlink, rm authorized_keys, rm ssh_host_*, cloud-init clean, graceful halt, qcow2 convert).
• proxmox-clone verified statically (packer validate); a live PVE build is intentionally deferred to the phase-2 self-hosted runner in spec 0002 (no token shared into the dev session).

Scope notes / follow-ups

• Tooling (zsh, kubectl, hardening, MOTD) is not installed here — that's Spec 0003: Move provisioning into PDS (select and apply) #3 (PDS migration).
• Automated offline artifact assertions (machine-id empty, no baked identity) and the live Proxmox verification are Spec 0002: Automated testing harness for image builds #2 (test harness).
• The legacy qemu-img → raw post-processor was dropped; qcow2 is the portable artifact for now.

Open (need your homelab values before a real Proxmox build)

Storage pool, bridge, node, and vmid ranges go in the untracked proxmox.auto.pkrvars.hcl; base template created once via create-base-template.sh.

[michielvha]

Good catch on the package trimming, applied. Corrected the philosophy: apt-native packages stay in cloud-init (git, net-tools, nmap, nfs-common, build-essential, zsh, btop, curl, file, qemu-guest-agent), and only genuinely non-apt things defer to PDS (#3): gh (needs the cli.github.com repo) and neofetch (deprecated, rides along with the MOTD). grub-efi-amd64/shim-signed stay dropped (amd64-only, unnecessary for a cloud image).

Re-ran packer build -only=qemu.ubuntu: green in 5m53s, all packages install cleanly.