proxmox: Delete with seed cleanup, health Checker, CRD type comment

Delete stops and destroys a VM of ours under the per-name lock, then
deletes its seed on the VM's node, or on every node when no VM of ours
was left. A hibernated VM of ours is Permanent, as in Create. The
Checker verifies each node concurrently (version, node status, ISO
storage, templates) and adds CertificateInvalid, CredentialsUnavailable,
StorageNotFound and TemplateNotFound to the shared reasons. The
ProviderHealth type comment gains proxmox.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/client.go

@@ -39,6 +39,10 @@ const (
 // Checker can report CredentialsUnavailable instead of an API failure.
 var errCredentials = errors.New("proxmox token file unusable")
 
+// errCAFile marks a CA file that is missing or holds no certificate, so the
+// Checker can report CertificateInvalid: the admin fixes caFile.
+var errCAFile = errors.New("proxmox CA file unusable")
+
 // tokenPattern is <user>@<realm>!<tokenid>=<secret> (spec entry 14).
 var tokenPattern = regexp.MustCompile(`^[^@\s]+@[^!\s]+![^=\s]+=\S+$`)
 
@@ -91,11 +95,11 @@ func (a *httpAPI) httpClient() (*http.Client, error) {
 	if a.caFile != "" && !a.insecure {
 		pem, err := os.ReadFile(a.caFile)
 		if err != nil {
-			return nil, fmt.Errorf("%w: reading CA file: %w", provider.ErrTransient, err)
+			return nil, fmt.Errorf("%w: %w: reading CA file: %w", provider.ErrTransient, errCAFile, err)
 		}
 		pool := x509.NewCertPool()
 		if !pool.AppendCertsFromPEM(pem) {
-			return nil, permanentf("CA file %s holds no PEM certificate", a.caFile)
+			return nil, fmt.Errorf("%w: %w: %s holds no PEM certificate", provider.ErrPermanent, errCAFile, a.caFile)
 		}
 		tlsCfg.RootCAs = pool
 	}