fix(ci): correct nested PVE node name and mask secrets in logs

- Change FQDN from pve-test.local to pve.test.local so the PVE node
  name is "pve" (matching what tests expect)
- Mask the dynamically created API token and VM IP with ::add-mask::
  before they appear in workflow logs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/integration-tests.yml

@@ -130,9 +130,12 @@ jobs:
             "${{ steps.terraform.outputs.vm_id }}" \
             "${PVE_PASSWORD}" \
             900)
-          echo "$OUTPUT"
           VM_IP=$(echo "$OUTPUT" | grep "^IP=" | cut -d= -f2)
           VM_TOKEN=$(echo "$OUTPUT" | grep "^TOKEN=" | cut -d= -f2-)
+          # Mask sensitive values before they appear in logs
+          echo "::add-mask::${VM_IP}"
+          echo "::add-mask::${VM_TOKEN}"
+          echo "Nested PVE ready at ${VM_IP}"
           echo "host=${VM_IP}" >> "$GITHUB_OUTPUT"
           echo "token=${VM_TOKEN}" >> "$GITHUB_OUTPUT"
 

tests/infrastructure/answer.toml.tftpl

@@ -1,7 +1,7 @@
 [global]
 keyboard = "en-us"
 country = "us"
-fqdn = "pve-test.local"
+fqdn = "pve.test.local"
 mailto = "test@test.local"
 timezone = "UTC"
 root_password = "${root_password}"