ci: storage and answer services move to a VM inside the CI sandbox (1/2)

The nested PVE guests live on an isolated VLAN with no route to the
runner network (ADR 0032, homelab repo), and the runner-hosted Docker
services died with each ephemeral ARC pod anyway. A small cloud-image VM
in the ci pool now serves NFS, iSCSI, and the auto-install answer files
from inside the sandbox. Includes fixes from Codex and in-house review:
bpg provider >= 0.79.0, serial console for the resized cloud image,
key-based SSH (cloud images refuse password auth), CIDR validation,
storage VM in the headroom check, docker socket mounts removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/infrastructure/main.tf

@@ -3,11 +3,8 @@ terraform {
   required_providers {
     proxmox = {
       source  = "bpg/proxmox"
-      version = ">= 0.70.0"
-    }
-    docker = {
-      source  = "kreuzwerker/docker"
-      version = ">= 3.0.0"
+      # disk.import_from and content_type "import" need >= 0.79.0
+      version = ">= 0.79.0"
     }
   }
 }
@@ -18,11 +15,6 @@ provider "proxmox" {
   insecure  = var.proxmox_insecure
 }
 
-provider "docker" {
-  # Uses the Docker socket from the dev-infra container
-  # (mounted at /var/run/docker.sock)
-}
-
 resource "proxmox_virtual_environment_file" "auto_iso" {
   for_each     = var.pve_isos
   content_type = "iso"
@@ -91,9 +83,10 @@ resource "proxmox_virtual_environment_vm" "nested_pve" {
 
   started = true
 
-  # VMs must not boot until the HTTP answer server is running,
-  # otherwise the PVE auto-installer can't fetch its answer file.
-  depends_on = [docker_container.answer_server]
+  # VMs must not boot until the storage VM exists — it serves the HTTP answer
+  # files the PVE auto-installer fetches. run-integration.sh additionally
+  # configures the storage VM (phase one) before applying these resources.
+  depends_on = [proxmox_virtual_environment_vm.storage]
 
   lifecycle {
     ignore_changes = [started, cdrom]