fix: pin answer server image digest + fix taint key mismatch

Copilot review fixes:
- Pin answer server Docker image to SHA256 digest instead of :latest
  for reproducible builds
- Fix cmd_taint: ISO resources are keyed by version ("9") not node
  ("9a"), so taint was no-op. Now taints ISOs by version and VMs
  by node separately.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/infrastructure/scripts/run-integration.sh

@@ -639,10 +639,12 @@ cmd_force_cleanup() {
 
 cmd_taint() {
     local requested="${1:-all}"
+    local taint_versions="$PVE_VERSIONS"
     local taint_nodes="$ALL_NODES"
     if [[ "$requested" != "all" ]]; then
+        taint_versions="$requested"
         taint_nodes=""
-        for v in $requested; do
+        for v in $taint_versions; do
             taint_nodes="$taint_nodes ${v}a ${v}b"
         done
     fi
@@ -650,12 +652,18 @@ cmd_taint() {
     log "Tainting PVE VMs for reprovisioning..."
     (cd "$INFRA_DIR" && terraform init -input=false 2>/dev/null)
 
+    # Taint ISOs (keyed by version, e.g. "9")
+    for v in $taint_versions; do
+        log "  Tainting ISO: PVE $v"
+        (cd "$INFRA_DIR" && \
+            terraform taint "proxmox_virtual_environment_file.auto_iso[\"$v\"]") 2>/dev/null || true
+    done
+
+    # Taint VMs (keyed by node, e.g. "9a")
     for node in $taint_nodes; do
         log "  Tainting VM: $node"
         (cd "$INFRA_DIR" && \
             terraform taint "proxmox_virtual_environment_vm.nested_pve[\"$node\"]") 2>/dev/null || true
-        (cd "$INFRA_DIR" && \
-            terraform taint "proxmox_virtual_environment_file.auto_iso[\"$node\"]") 2>/dev/null || true
     done
 
     log "Taint complete. Next 'provision' will recreate these VMs."

tests/infrastructure/storage.tf

@@ -2,7 +2,9 @@
 
 resource "docker_container" "answer_server" {
   name     = "pvetest-answer-server"
-  image    = "slothcroissant/proxmox-auto-installer-server:latest"
+  # Pin to digest for reproducibility. Update by pulling latest and running:
+  #   docker inspect slothcroissant/proxmox-auto-installer-server:latest --format '{{index .RepoDigests 0}}'
+  image    = "slothcroissant/proxmox-auto-installer-server@sha256:0f45d7bfe6e3cc76aa00fc578e40b80b9054e377db18a79122866fe5522bc7ed"
   restart  = "unless-stopped"
   must_run = true
   start    = true