proxmox: Create by cloning a template, seed upload, config, start

Create validates placement, then under the per-name lock adopts the VM a
previous attempt left (by name, or at a taken VMID after the ownership
check of spec entry 2) or full-clones the template onto the UID's
deterministic VMID with the mark in the clone call. It then uploads the
seed over any existing file, writes cores, memory, agent, tag, ide2 and
net0 when configured, grows the boot disk when diskGiB is larger, starts,
and waits for running/running.

waitUnlocked no longer waits on a suspended lock: a hibernated VM is
judged at once, so ours is Permanent and a foreign one is probed past.
The template is checked only on the allocation path, and its shape
(net0, boot disk size) is refused before any clone exists. Spec entries
2, 4 and 10 updated to match.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/task_test.go

@@ -160,8 +160,10 @@ func TestWaitUnlocked_table(t *testing.T) {
 		cancelled bool
 		wantErr   func(error) bool
 		wantCalls int
+		wantLock  string
 	}{
 		{name: "unlocked answers at once", wantCalls: 1},
+		{name: "suspended lock is not waited on", lock: lockSuspended, budget: time.Hour, wantCalls: 1, wantLock: lockSuspended},
 		{
 			name: "waits until the lock clears", lock: "clone", wantCalls: 3,
 			onCall: func(f *fakeAPI, n int) {
@@ -219,8 +221,8 @@ func TestWaitUnlocked_table(t *testing.T) {
 			}
 			cfg, err := fx.p.waitUnlocked(ctx, fakeNode, testVMID, budget)
 			if tc.wantErr == nil {
-				if err != nil || cfg["name"] != testName || cfg["lock"] != "" {
-					t.Errorf("waitUnlocked = %v, %v; want the unlocked config", cfg, err)
+				if err != nil || cfg["name"] != testName || cfg["lock"] != tc.wantLock {
+					t.Errorf("waitUnlocked = %v, %v; want the config with lock %q", cfg, err, tc.wantLock)
 				}
 			} else if !tc.wantErr(err) || cfg != nil {
 				t.Errorf("waitUnlocked = %v, %v; want no config and the expected error", cfg, err)