Fix nix-cache retry storms and lxc creation in create-proxmox-resource.sh

Two independent problems found while actually running the script:

1. nix build/nix-shell retry each unreachable substituter/builder up to
   5x with backoff, per store path -- with nix-cache down this compounds
   into minutes of noise. scripts/env.sh gains nix_extra_opts(), which
   probes http://nix-cache and nixremote@nix-cache:22 once via plain
   curl/TCP (bypassing Nix's own retry logic entirely -- confirmed
   nix store ping still retries 5x even with a short connect-timeout)
   and exports the decision so create-proxmox-resource.sh and the
   sync-host-keys.sh subprocess it shells out to both reuse it instead
   of probing independently.

2. The actual failure: "archive contains no configuration file". pct
   restore expects a vzdump backup archive with embedded config;
   config.system.build.tarball is a plain CT template tarball -- wrong
   Proxmox mechanism entirely. Fixed to pct create against it as a vztmpl
   template instead, uploaded to /var/lib/vz/template/cache/ rather than
   /var/lib/vz/dump/. This same wrong claim had propagated into
   docs/auto-installer.md, README.md, and CLAUDE.md from when the script
   was first written -- corrected everywhere.

Also: checks for an already-uploaded image on the node (fixed
<flake_target>.tar.xz/.raw naming) before building, skipping build+upload
entirely if found (--force-rebuild to always rebuild).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

CLAUDE.md

@@ -86,12 +86,16 @@ Beyond `codex-setup.sh`/`codex-maintenance.sh` above, `scripts/` also has:
   has.
 - `scripts/create-proxmox-resource.sh` — builds a `lxc-*`/`proxmox-*`
   target's tarball/disk image and creates it on a real Proxmox node
-  (`pct restore` / `qm create`+`importdisk`), or reconfigures an existing
-  resource's cores/memory/disk size (`--modify`, always requires typing the
-  VMID back to confirm). Refuses to create a target whose host identity
-  already has a real deployment elsewhere (`variables.nix`'s
-  `deployedTargets`) unless `--allow-duplicate-host` is passed.
-  `--dry-run` throughout both modes.
+  (`pct create` against the tarball as a CT template / `qm create`+
+  `importdisk`), or reconfigures an existing resource's cores/memory/disk
+  size (`--modify`, always requires typing the VMID back to confirm).
+  Checks for an already-uploaded image on the node before building
+  (`--force-rebuild` to skip that and always rebuild), and probes
+  nix-cache's substituter/remote-builder reachability once up front rather
+  than letting every `nix build` call retry against it individually.
+  Refuses to create a target whose host identity already has a real
+  deployment elsewhere (`variables.nix`'s `deployedTargets`) unless
+  `--allow-duplicate-host` is passed. `--dry-run` throughout both modes.
 - `scripts/env.sh` — shared config (`PROXMOX_HOST`, storage pool, bridge,
   default cores/memory) sourced by `create-proxmox-resource.sh`. Add new
   cross-script config here instead of duplicating it per-script.
@@ -153,8 +157,10 @@ removing a host.
   from `flake.nix`. `lxc.nix` has no hardware-configuration counterpart since
   containers share the host kernel; instead it imports nixpkgs' own
   `virtualisation/proxmox-lxc.nix`, which gives every `lxc-*` host a
-  `config.system.build.tarball` output (`pct restore`-ready, no install step
-  — see `docs/auto-installer.md`).
+  `config.system.build.tarball` output — a plain rootfs tarball, used as a
+  `pct create ... vztmpl` CT template (**not** `pct restore`, which expects
+  `vzdump` backup-archive metadata this doesn't have), no install step —
+  see `docs/auto-installer.md`.
 - `modules/build-types/*.nix` — what a system is for:
   minimal/server/docker/gui/pxe-boot/nix-cache.
 - `modules/common/configuration.nix` — base NixOS config imported by every