proxmox: review fixes, real-host validation record, changelog

Phase 10. Two review passes (go-operator-reviewer, /code-review high)
over the branch, recorded in docs/reviews/2026-09-23-proxmox-provider-review/:
9 findings fixed, 3 accepted as documented limits, 7 rejected with a
reason.

- Delete removes the seed between the stop and the destroy, so a failed
  seed delete leaves the VM for the next Delete instead of leaking the
  ISO; a Permanent refusal on the every-node path fails the call.
- Create skips a probe VMID whose listed name is someone else's without
  waiting on its lock.
- The three answers Phase 0 never captured are fixtures now: a missing
  storage is a 400 (the Checker reports StorageNotFound), a hibernated
  VM is destroyable (Delete destroys ours), a paused VM stops.
- TestProxmox_lifecycle and TestProxmoxCheck_realHost passed on pv1-1
  (PVE 9.2.20); the docs record the run and drop "not yet run".

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/create.go

@@ -198,9 +198,10 @@ func (p *Provider) template(ctx context.Context, rs []vmResource, image string,
 }
 
 // allocate is the probe of spec entry 2: the attempt-th VMID for the UID
-// is cloned onto when the listing shows it free and put through the
+// is cloned onto when the listing shows it free, and put through the
 // ownership check when it is taken, or when the clone finds it taken after
-// all (F4). The boolean reports an adoption rather than a fresh clone.
+// all (F4), by a VM that is nameless or carries our name. The boolean
+// reports an adoption rather than a fresh clone.
 func (p *Provider) allocate(ctx context.Context, log logr.Logger, rs []vmResource, node string, src vmResource, req provider.CreateRequest) (ownedVM, bool, error) {
 	taken := make(map[int]vmResource, len(rs))
 	for _, r := range rs {
@@ -225,7 +226,9 @@ func (p *Provider) allocate(ctx context.Context, log logr.Logger, rs []vmResourc
 				continue
 			}
 		}
-		if r.Type == "qemu" && r.Template == 0 {
+		// A listed name other than ours is someone else's VM whatever its
+		// lock: only a clone in progress is nameless.
+		if r.Type == "qemu" && r.Template == 0 && (r.Name == "" || r.Name == req.Name) {
 			vm, ours, err := p.inspect(ctx, r, req)
 			if err != nil || ours {
 				return vm, ours, err