provider: extract nocloud seed builder and keyedlock from kvm2

kvm2's NoCloud seed builder moves to internal/provider/nocloud (exported,
with an ErrEmptyName sentinel instead of permanentf) and its keyed locks
to internal/provider/keyedlock, tests moved under their existing names.
kvm2 behaviour is unchanged. proxmox gains the per-name lock and the pure
seed helpers (seedISOName, seedVolID, buildSeed); unlike kvm2 (review
finding S5.1), a seed staging failure there is Transient, not Permanent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/seed.go

@@ -0,0 +1,43 @@
+package proxmox
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
+	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider/nocloud"
+)
+
+// seedISOName is the seed's file name on the ISO storage. Upload refuses a
+// name without the .iso suffix (F12), and GC's blind spot is documented by
+// this pattern (spec entry 11).
+func seedISOName(name string) string {
+	return name + "-seed.iso"
+}
+
+// seedVolID is the seed's volume id, as ide2 references it and as the
+// storage content delete takes it.
+func seedVolID(storage, name string) string {
+	return storage + ":iso/" + seedISOName(name)
+}
+
+// buildSeed renders the NoCloud seed for req in memory (spec entry 5): a
+// seed is tens of KiB. Nothing about its content is logged or put in an
+// error. Only an empty name is Permanent; a staging failure (no /tmp, a
+// full emptyDir) is left unclassified, so classify makes it Transient and
+// the reconciler retries instead of latching the Proxy.
+func (p *Provider) buildSeed(req provider.CreateRequest) (*bytes.Buffer, error) {
+	vendorData, err := nocloud.BuildVendorData(p.cfg.VendorData, *p.cfg.InstallGuestAgent)
+	if err != nil {
+		return nil, fmt.Errorf("building vendor-data for %s: %w", req.Name, err)
+	}
+	var iso bytes.Buffer
+	if err := nocloud.BuildSeedISO(req.Name, req.CloudInit, vendorData, &iso); err != nil {
+		if errors.Is(err, nocloud.ErrEmptyName) {
+			return nil, permanentf("building seed ISO: %v", err)
+		}
+		return nil, fmt.Errorf("building seed ISO for %s: %w", req.Name, err)
+	}
+	return &iso, nil
+}