Fix NFS shares never mounting on lxc-docker

Two compounding bugs, confirmed live on the running lxc-docker
container (vmid 102 on pve.sweet.home):

1. x-systemd.automount never works inside any Linux container --
   systemd logs "Starting of <unit>.automount unsupported" for every
   share and never mounts them. modules/docker/mount-data.nix and
   modules/raspi/mount-data.nix now key off config.boot.isContainer
   (set true by nixpkgs' proxmox-lxc.nix) to mount eagerly with
   `nofail` there instead, while VM-based docker targets keep automount
   unchanged.

2. The container's Proxmox `features` never included `mount=nfs`, so
   AppArmor blanket-denies the nfs/rpc_pipefs mount syscalls NFS
   needs ("permission denied"). scripts/env.sh's
   PROXMOX_DEFAULT_LXC_FEATURES now includes mount=nfs;nfs4 for future
   lxc-* containers -- the semicolon required quoting the --features
   value in create-proxmox-resource.sh's remote pct-create command,
   since it's sent as a raw string for the remote shell to parse and an
   unquoted `;` would be read as a command separator.

The already-running container needs a matching `pct set --features`
plus a restart to pick this up -- that's an operator step outside this
repo.

scripts/create-proxmox-resource.sh

@@ -521,7 +521,17 @@ if [[ "$type" == "lxc" ]]; then
   # systemd routinely uses (even plain getty units), and every getty
   # crash-loops on a denied mount every ~3s (visible as garbage on the
   # console) while core services like nsncd fail the same way.
-  create_cmd="pct create ${vmid} ${iso_storage}:vztmpl/${remote_filename} --unprivileged 1 --features ${PROXMOX_DEFAULT_LXC_FEATURES} --rootfs ${storage}:${local_disk_size} --hostname ${name} --cores ${cores} --memory ${memory} --swap ${local_swap} --net0 name=eth0,bridge=${bridge},ip=dhcp"
+  #
+  # ...,mount=nfs;nfs4: without it AppArmor blanket-denies the `nfs`/
+  # `rpc_pipefs` mount syscalls any NFS client share needs -- confirmed
+  # live on lxc-docker: `mount: /var/lib/nfs/rpc_pipefs: permission
+  # denied`. The value's `;` (Proxmox's own multi-fstype separator for
+  # this one feature, per PVE::LXC's use of PVE::ParseUtils::split_list)
+  # must stay single-quoted here: create_cmd is sent to `remote()`, which
+  # hands the whole string to `ssh` as a single command for the *remote*
+  # shell to parse -- unquoted, that `;` would be read as a remote
+  # command separator and silently truncate this into two commands.
+  create_cmd="pct create ${vmid} ${iso_storage}:vztmpl/${remote_filename} --unprivileged 1 --features '${PROXMOX_DEFAULT_LXC_FEATURES}' --rootfs ${storage}:${local_disk_size} --hostname ${name} --cores ${cores} --memory ${memory} --swap ${local_swap} --net0 name=eth0,bridge=${bridge},ip=dhcp"
   remote "$create_cmd"
   remote "pct start ${vmid}"
 else

scripts/env.sh

@@ -45,7 +45,15 @@
 # crash-loops on a denied `/run/credentials/*` mount every ~3s (visible
 # as garbage on the console) and core services like nsncd fail the same
 # way on userns_create; system.build.tarball never finishes activating.
-: "${PROXMOX_DEFAULT_LXC_FEATURES:=nesting=1,keyctl=1}"
+#
+# mount=nfs;nfs4: without it, AppArmor blanket-denies the `nfs`/
+# `rpc_pipefs` mount syscalls any NFS client share needs -- confirmed
+# live on lxc-docker (which mounts several, see modules/docker/mount-data.nix
+# and modules/raspi/mount-data.nix): `mount: /var/lib/nfs/rpc_pipefs:
+# permission denied`. Harmless to grant on lxc targets that don't mount
+# NFS at all -- it only widens what the container is *allowed* to mount,
+# nothing here forces a mount to happen.
+: "${PROXMOX_DEFAULT_LXC_FEATURES:=nesting=1,keyctl=1,mount=nfs;nfs4}"
 
 export PROXMOX_HOST PROXMOX_SSH_USER PROXMOX_STORAGE PROXMOX_ISO_STORAGE \
   PROXMOX_BRIDGE PROXMOX_DEFAULT_CORES PROXMOX_DEFAULT_MEMORY_MB \