Enable QEMU guest agent on Proxmox VMs; register lxc-gui sops key

create-proxmox-resource.sh's `qm create` never passed --agent, so despite
services.qemuGuest.enable = true being set on every host, Proxmox never
created the virtio-serial channel the guest agent needs -- qm guest exec
and the UI's IP-address display silently never worked for any VM this
script created. Found while live-testing every lxc-*/proxmox-* build type
against pve.sweet.home for an end-to-end flake audit.

Also registers a fresh sops age key for lxc-gui (no prior registration
existed), generated while testing that target live -- needed before
lxc-gui can be deployed with working secrets.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CZHwwAM7cacQKkqKfQ5e8a

scripts/proxmox/create-proxmox-resource.sh

@@ -797,9 +797,15 @@ else
   echo "==> Creating VM ${vmid} (${name})..."
   # pre-enrolled-keys=0 disables OVMF's Secure Boot key pre-enrollment --
   # required, or systemd-boot (unsigned) can't be trusted by the firmware.
+  # --agent 1: wires up the virtio-serial channel QEMU exposes to the guest.
+  # modules/common/configuration.nix sets services.qemuGuest.enable = true
+  # on every host, so the guest-side qemu-ga daemon is already running --
+  # without this flag Proxmox never creates the channel it listens on, so
+  # `qm guest exec`/`qm agent` and the UI's IP-address display silently
+  # never work for any VM this script creates.
   remote "qm create ${vmid} --name ${name} --memory ${memory} --cores ${cores} \
 --net0 virtio,bridge=${bridge} --bios ovmf --machine q35 --scsihw virtio-scsi-pci \
---efidisk0 ${storage}:1,efitype=4m,pre-enrolled-keys=0"
+--efidisk0 ${storage}:1,efitype=4m,pre-enrolled-keys=0 --agent enabled=1"
 
   if [[ "$dry_run" -eq 1 ]]; then
     echo "[dry-run] ssh ${ssh_target} -- qm importdisk ${vmid} ${remote_path} ${storage}"