chore: add apt-get upgrade to first-boot script

Ensures nested PVE nodes are fully patched before integration tests
run. Adds ~5-10min to first provision but gives more realistic test
results against current PVE releases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/infrastructure/scripts/first-boot.sh

@@ -19,6 +19,7 @@ fi
 echo "deb http://download.proxmox.com/debian/pve ${SUITE} pve-no-subscription" > /etc/apt/sources.list.d/pve-no-subscription.list
 
 apt-get update -qq
+apt-get upgrade -y -qq
 apt-get install -y -qq qemu-guest-agent open-iscsi
 systemctl start qemu-guest-agent
 systemctl enable open-iscsi