proxmox: contract and observability tests, integration test, testing docs

The contract sweep in provider_test.go: every method and Check returns
within a second of a cancel, every wrapErr path carries the configured
name, op and id, the V0/V1/V2 logging tiers and the no-op lines, and a
Get over the real client whose HTTP spans are children of provider.get.
proxmox_integration_test.go (-tags=integration) holds TestProxmox_lifecycle
and TestProxmoxCheck_realHost; both compile and skip without
PROXMOX_TEST_*, and have not run against a host yet. make
test-integration-proxmox runs them. docs/testing.md gains the proxmox,
nocloud and keyedlock rows, the Live Proxmox gaps and the integration
section; spec entry 21's section 11 list is ticked.

Waits that could hang the package under a mutation are bounded: the
concurrent-Create loop and eight direct blocking calls in older tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/delete_test.go

@@ -623,7 +623,7 @@ func TestDelete_waitsOnTheNameLock(t *testing.T) {
 	defer release()
 	ctx, cancel := context.WithTimeout(fx.ctx, 20*time.Millisecond)
 	defer cancel()
-	err = fx.p.Delete(ctx, fx.id())
+	within(t, 5*time.Second, func() { err = fx.p.Delete(ctx, fx.id()) })
 	assertProviderError(t, err, "delete", provider.ErrTransient)
 	if !errors.Is(err, context.DeadlineExceeded) {
 		t.Errorf("error = %v, want it to wrap DeadlineExceeded", err)
@@ -647,7 +647,8 @@ func TestDelete_cancelledMidWaitReturnsPromptly(t *testing.T) {
 		return nil
 	})
 	start := time.Now()
-	err := fx.p.Delete(ctx, fx.id())
+	var err error
+	within(t, 10*time.Second, func() { err = fx.p.Delete(ctx, fx.id()) })
 	if elapsed := time.Since(start); elapsed > 5*time.Second {
 		t.Errorf("Delete took %v after cancellation", elapsed)
 	}