Fix nix-cache retry storms and lxc creation in create-proxmox-resource.sh

Two independent problems found while actually running the script:

1. nix build/nix-shell retry each unreachable substituter/builder up to
   5x with backoff, per store path -- with nix-cache down this compounds
   into minutes of noise. scripts/env.sh gains nix_extra_opts(), which
   probes http://nix-cache and nixremote@nix-cache:22 once via plain
   curl/TCP (bypassing Nix's own retry logic entirely -- confirmed
   nix store ping still retries 5x even with a short connect-timeout)
   and exports the decision so create-proxmox-resource.sh and the
   sync-host-keys.sh subprocess it shells out to both reuse it instead
   of probing independently.

2. The actual failure: "archive contains no configuration file". pct
   restore expects a vzdump backup archive with embedded config;
   config.system.build.tarball is a plain CT template tarball -- wrong
   Proxmox mechanism entirely. Fixed to pct create against it as a vztmpl
   template instead, uploaded to /var/lib/vz/template/cache/ rather than
   /var/lib/vz/dump/. This same wrong claim had propagated into
   docs/auto-installer.md, README.md, and CLAUDE.md from when the script
   was first written -- corrected everywhere.

Also: checks for an already-uploaded image on the node (fixed
<flake_target>.tar.xz/.raw naming) before building, skipping build+upload
entirely if found (--force-rebuild to always rebuild).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

scripts/env.sh

@@ -26,5 +26,57 @@
 : "${PROXMOX_DEFAULT_CORES:=2}"
 : "${PROXMOX_DEFAULT_MEMORY_MB:=2048}"
 
+# `pct create` (unlike `pct restore`) requires an explicit rootfs size --
+# no backup metadata to infer it from. Matches Proxmox's own GUI default.
+: "${PROXMOX_DEFAULT_LXC_DISK_GB:=8}"
+
 export PROXMOX_HOST PROXMOX_SSH_USER PROXMOX_STORAGE PROXMOX_ISO_STORAGE \
-  PROXMOX_BRIDGE PROXMOX_DEFAULT_CORES PROXMOX_DEFAULT_MEMORY_MB
+  PROXMOX_BRIDGE PROXMOX_DEFAULT_CORES PROXMOX_DEFAULT_MEMORY_MB PROXMOX_DEFAULT_LXC_DISK_GB
+
+# Matches variables.nix's nixCacheHost -- update both if it ever changes.
+: "${NIX_CACHE_HOST:=nix-cache}"
+export NIX_CACHE_HOST
+
+# nix_extra_opts: call as a plain statement (NOT inside $(...)/<(...) --
+# that forks a subshell, and the whole point is exporting a decision back
+# into *this* shell) to populate the global NIX_OPTS array with whatever
+# extra `nix`/`nix-shell` CLI options are needed to avoid nix-cache when
+# it's unreachable:
+#   nix_extra_opts
+#   nix build "${NIX_OPTS[@]}" ...
+#
+# Without this, every single `nix eval`/`nix build` call retries each
+# store path against a dead substituter up to 5 times with backoff
+# (confirmed: ~15s+ per lookup even with a short connect-timeout, because
+# nix's own retry count isn't controllable that way), and separately
+# tries it as a remote builder too -- both fail independently, so both
+# are checked.
+#
+# Checked with a single fast `curl`/TCP probe (bypassing nix's retry logic
+# entirely) the first time this is called in a given process, and the
+# result is exported as NIX_EXTRA_OPTS so a script that shells out to
+# another script in this repo (e.g. create-proxmox-resource.sh calling
+# sync-host-keys.sh) reuses the same decision instead of probing twice.
+declare -a NIX_OPTS=()
+
+nix_extra_opts() {
+  if [[ -n "${NIX_EXTRA_OPTS_DECIDED:-}" ]]; then
+    if [[ -n "${NIX_EXTRA_OPTS:-}" ]]; then
+      eval "NIX_OPTS=(${NIX_EXTRA_OPTS})"
+    else
+      NIX_OPTS=()
+    fi
+    return
+  fi
+  export NIX_EXTRA_OPTS_DECIDED=1
+  NIX_OPTS=()
+  if ! curl --silent --fail --max-time 3 "http://${NIX_CACHE_HOST}/nix-cache-info" >/dev/null 2>&1; then
+    echo "nix-cache (http://${NIX_CACHE_HOST}) is unreachable -- skipping it (substituter + remote builder) for the rest of this run." >&2
+    NIX_OPTS=(--option substituters "https://cache.nixos.org/" --builders "")
+  elif ! timeout 3 bash -c "cat < /dev/tcp/${NIX_CACHE_HOST}/22" >/dev/null 2>&1; then
+    echo "nix-cache's SSH remote builder (nixremote@${NIX_CACHE_HOST}:22) is unreachable -- disabling remote builds for the rest of this run." >&2
+    NIX_OPTS=(--builders "")
+  fi
+  printf -v NIX_EXTRA_OPTS '%q ' "${NIX_OPTS[@]}"
+  export NIX_EXTRA_OPTS
+}