refactor(ci): parallel provisioning, file caching, provision/test/cleanup split

Restructures the integration test workflow from a monolithic sequential
job into separate provision → test → cleanup stages:

- provision: creates ALL nested PVE VMs in a single terraform apply
  (parallel), waits for APIs, creates tokens, passes outputs to tests
- test: matrix [pve9, pve8] consumes provision outputs, no provisioning
- cleanup: always runs, API-only teardown for all VMs

Terraform refactored to for_each with pve_instances map variable,
enabling parallel ISO upload and VM creation.

New caching scripts reduce redundant downloads:
- ensure-base-iso.sh: downloads PVE ISOs to /opt/pve-isos if missing
- ensure-cloud-images.sh: caches cloud image + OVA with 7-day TTL
- prepare-auto-iso.sh: --cache-dir flag with hash-based skip

Runner no longer needs manual ISO provisioning (zero-touch setup).
cleanup-images bumped to min-versions-to-keep: 3 to survive overlapping
runs. All jobs gated against dependabot.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/infrastructure/main.tf

@@ -15,19 +15,21 @@ provider "proxmox" {
 }
 
 resource "proxmox_virtual_environment_file" "auto_iso" {
+  for_each     = var.pve_instances
   content_type = "iso"
   datastore_id = var.iso_storage
   node_name    = var.target_node
 
   source_file {
-    path = var.iso_local_path
+    path = each.value.iso_local_path
   }
 }
 
 resource "proxmox_virtual_environment_vm" "nested_pve" {
-  name      = var.vm_name
+  for_each  = var.pve_instances
+  name      = each.value.vm_name
   node_name = var.target_node
-  vm_id     = var.vm_id
+  vm_id     = each.value.vm_id
 
   machine    = "q35"
   bios       = "ovmf"
@@ -56,7 +58,7 @@ resource "proxmox_virtual_environment_vm" "nested_pve" {
   }
 
   cdrom {
-    file_id   = proxmox_virtual_environment_file.auto_iso.id
+    file_id   = proxmox_virtual_environment_file.auto_iso[each.key].id
     interface = "ide2"
   }