proxmox: contract and observability tests, integration test, testing docs

The contract sweep in provider_test.go: every method and Check returns
within a second of a cancel, every wrapErr path carries the configured
name, op and id, the V0/V1/V2 logging tiers and the no-op lines, and a
Get over the real client whose HTTP spans are children of provider.get.
proxmox_integration_test.go (-tags=integration) holds TestProxmox_lifecycle
and TestProxmoxCheck_realHost; both compile and skip without
PROXMOX_TEST_*, and have not run against a host yet. make
test-integration-proxmox runs them. docs/testing.md gains the proxmox,
nocloud and keyedlock rows, the Live Proxmox gaps and the integration
section; spec entry 21's section 11 list is ticked.

Waits that could hang the package under a mutation are bounded: the
concurrent-Create loop and eight direct blocking calls in older tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/check_test.go

@@ -117,7 +117,8 @@ func TestCheck_expiredContextReturnsPromptly(t *testing.T) {
 	ctx, cancel := context.WithTimeout(fx.ctx, 0)
 	defer cancel()
 	start := time.Now()
-	got := fx.p.Check(ctx)
+	var got []provider.TargetStatus
+	within(t, 5*time.Second, func() { got = fx.p.Check(ctx) })
 	if elapsed := time.Since(start); elapsed > time.Second {
 		t.Errorf("Check() took %v with an expired ctx, want under 1s", elapsed)
 	}
@@ -321,7 +322,8 @@ func TestCheck_reasonsTable(t *testing.T) {
 				ctx, cancel = context.WithCancel(ctx)
 				time.AfterFunc(50*time.Millisecond, cancel)
 			}
-			got := fx.p.Check(ctx)
+			var got []provider.TargetStatus
+			within(t, 5*time.Second, func() { got = fx.p.Check(ctx) })
 			if len(got) != 1 {
 				t.Fatalf("Check() returned %d targets, want 1", len(got))
 			}