proxmox: Create by cloning a template, seed upload, config, start

Create validates placement, then under the per-name lock adopts the VM a
previous attempt left (by name, or at a taken VMID after the ownership
check of spec entry 2) or full-clones the template onto the UID's
deterministic VMID with the mark in the clone call. It then uploads the
seed over any existing file, writes cores, memory, agent, tag, ide2 and
net0 when configured, grows the boot disk when diskGiB is larger, starts,
and waits for running/running.

waitUnlocked no longer waits on a suspended lock: a hibernated VM is
judged at once, so ours is Permanent and a foreign one is probed past.
The template is checked only on the allocation path, and its shape
(net0, boot disk size) is refused before any clone exists. Spec entries
2, 4 and 10 updated to match.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/proxmox.go

@@ -173,14 +173,8 @@ func (p *Provider) lockName(ctx context.Context, name string) (func(), error) {
 	return release, nil
 }
 
-// Create and Delete are stubs until the phases that implement them (Create
-// in 6, Delete in 7). Each answers Transient, so a Proxy on this provider
-// retries rather than latching.
-
-func (p *Provider) Create(_ context.Context, req provider.CreateRequest) (string, error) {
-	return "", p.wrapErr("create", "", transientf("proxmox Create is not implemented yet (request %s)", req.Name))
-}
-
+// Delete is a stub until Phase 7. It answers Transient, so a Proxy on this
+// provider retries rather than latching.
 func (p *Provider) Delete(_ context.Context, id string) error {
 	return p.wrapErr("delete", id, transientf("proxmox Delete is not implemented yet"))
 }