[bloogefest]

Summary

• modules/providers/proxmox (bpg/proxmox 0.116.0): VMs for the Proxmox pools of clusters created by OpenTofu.
• Ubuntu: full clone of the newest tagged template from images (numeric sort by run and attempt; kubeadm
  requires the k8s-<major>-<minor> tag). Talos: Image Factory nocloud ISO with a required SHA-256.
• Static IPv4, DNS and the SSH user through cloud-init; q35 + OVMF like the templates; size catalog applied.
• Newer templates or Talos versions never replace existing VMs (ignore_changes on clone and cdrom).
• Output nodes in the normalized node contract; templates, clone_sources, talos_iso.
• Tests run the real cluster-spec and pass its output in; ADR 0004.

Checks

• tofu fmt -check, tofu validate, tofu test for affected modules
• tflint, Checkov, Conftest policies and fixtures
• yamllint, actionlint, zizmor
• gitleaks: no secrets, no personal values (addresses, domains, IDs)
• Versions pinned exactly (README → Versions)
• Module README (terraform-docs), docs/configuration.md, CHANGELOG updated
• Contracts (cluster description, node, inventory) unchanged, or the change is agreed and has an ADR
• Both topologies (single, ha) covered where applicable