chore: repair the local dev path and delete its dead scaffolding

The local dev environment had drifted badly from CI. Remove the parts that no
longer describe anything real, and make the rest match how CI actually runs.

Delete tests/dev.ps1. It wrapped run-integration.sh, which CI calls directly,
and duplicated the module build that script already performs internally. As a
second entry point it drifted: it still offered the PVE 8 leg retired in #88,
mounted the Docker socket for storage containers replaced by the storage VM in
#87, and pointed its remote-host examples at a runner decommissioned in the ARC
migration. All four documents describing it used a positional syntax that bound
the bare word to -Tests and then fell through to -Shell, so every documented
command silently opened a container shell. Recorded as D019.

Delete tests/infrastructure/runner/, a self-hosted-runner-in-Docker superseded
by Actions Runner Controller.

Make disk_storage and iso_storage required. Their defaults named a NAS that the
lab replaced with Ceph, and CI overrides both from repository variables, so the
defaults only ever misled local runs. require_env now fails at the top of a run
rather than at terraform apply, and the descriptions point at tests/.env.test
because cmd_provision deletes terraform.tfvars before applying.

preflight-cleanup.sh no longer falls back to the literal "local" storage. An
unset TF_VAR_iso_storage now skips only the ISO branch, leaving VM destroy and
state cleanup intact, and emits a workflow annotation: force-cleanup is the
only cleanup CI runs and it wipes Terraform state, so a silent skip strands the
uploaded ISO with nothing left to reclaim it.

Drop docker-ce-cli and the /var/run/docker.sock mount. Nothing in the container
has called docker since #87 moved storage into a VM; the remaining docker calls
run inside that VM over SSH. The CI job image is built from the same target, so
this also removes a third-party apt repository from its supply chain.

Rewrite tests/.env.test.example against what the code now requires, and fix the
documented commands in CLAUDE.md, README.md, copilot-instructions.md and the
integration README.

tests/docker-compose.test.yml

@@ -4,9 +4,11 @@
 ##   docker compose -f tests/docker-compose.test.yml up -d
 ##   docker exec -it psproxmoxve-dev pwsh
 ##
-## Full CI infra (x86 only — adds Terraform + PVE provisioning tools):
-##   docker compose -f tests/docker-compose.test.yml --profile infra up -d
-##   docker exec -it psproxmoxve-dev-infra bash
+## Full CI infra (x86 only — adds Terraform + PVE provisioning tools).
+## dev-infra is the same image CI runs its jobs in (Dockerfile.test target
+## dev-infra), so the local flow is the CI flow:
+##   docker compose -f tests/docker-compose.test.yml --profile infra run --rm \
+##       dev-infra bash tests/infrastructure/scripts/run-integration.sh provision 9
 ##
 ## Stop:
 ##   docker compose -f tests/docker-compose.test.yml down
@@ -38,9 +40,6 @@ services:
     volumes:
       - ..:/repo
       - /opt/pve-integration:/opt/pve-integration
-      # WARNING: Mounting the Docker socket grants this container root-equivalent
-      # access to the host's Docker daemon. Only use on trusted, isolated machines.
-      - /var/run/docker.sock:/var/run/docker.sock
     working_dir: /repo
     stdin_open: true
     tty: true