[astrojerms]

Changes

• Replace unsupported REST snippet uploads with atomic SSH delivery through explicit per-node mappings and verified host keys.
• Thread local SSH configuration through provider contexts without putting key material in manifests.
• Apply requested cloud-image disk options after resize and before startup; preserve existing volume/options.
• Add safety and failure-path regression coverage; update provider/homelab documentation.

Verification

• Full root Go suite: 41 packages passed.
• Linux client tests passed, including real filesystem atomic replacement and failed-upload preservation.
• Built all binaries and exercised the real Proxmox 9.1.1 homelab through openctl: cloud-init delivery, static networking, 8 vCPU/10 GiB/300 GiB SSD+TRIM, developer tooling, agent SSH/sudo denial, rootless container execution and offline Codex sandbox.
• Created and listed the dev-system-ready disk-only recovery snapshot; restored the controller baseline and removed smoke scaffolding.

Closes #159
Closes #161