Proxmox: cloudImage.checksum is accepted but ignored when downloading images #160

Observed

spec.cloudImage.checksum is accepted by the VM schema and parsed into resources.CloudImageRef.Checksum, but is never passed to the Proxmox image-download request.

Evidence

• internal/schema/schemas/proxmox/vm.cue documents checksum?: string as verification of the download (example sha256:abc123).
• pkg/proxmox/handler/handler.go:createCloudImageTemplate calls DownloadToStorage with URL, filename and content type only.
• pkg/proxmox/client/client.go:DownloadToStorage submits only url, filename, and content.

An isolated native handler smoke used a schema-valid manifest with checksum: "sha256:" + 64 zeroes. A disposable HTTPS Proxmox fixture captured the download request:

url=https://example.invalid/noble.img content=import filename=noble.qcow2 checksum="" checksum-algorithm=""

The fixture intentionally stopped at this request; it downloaded no image and created no VM/template.

Impact

A manifest can appear to pin image integrity while providing no digest verification. A wrong digest does not prevent the provider from starting the download, importing the image, and creating a template.

Expected

Parse the supported checksum format and send Proxmox's checksum and checksum-algorithm parameters (or verify the image through another real supported mechanism). A mismatch must fail before importing/using the image. Reject unsupported/malformed checksum formats rather than silently ignoring them.

Reproduction

1. Supply a schema-valid cloudImage with a non-empty sha256:<digest> checksum.
2. Run the existing cloud-image create handler against an isolated API fixture.
3. Capture the first /storage/<storage>/download-url request: neither checksum parameter is sent.