Add sync-host-keys.sh and create-proxmox-resource.sh

sync-host-keys.sh: generates/registers SSH host keys and their
.sops.yaml/secrets/*.yaml recipients for flake targets, idempotently.
--all, <target>, --remove, --regenerate-all-keys, all with --dry-run
(verified zero-side-effect via a sandboxed git-status check across every
mode). Only ever touches anchors with a corresponding host-keys/ file --
&admin and any hand-registered real-host anchor are never listed,
removed, or regenerated. Supersedes running prepare-host-key.sh one host
at a time for any target that already has a flake entry.

create-proxmox-resource.sh: builds a lxc-*/proxmox-* target's
tarball/disk image and creates it on a real Proxmox node, or reconfigures
an existing resource's cores/memory/disk (--modify, always requires
typing the VMID back to confirm). Refuses to create a new resource for a
VMID that already exists, and refuses to duplicate a host identity that
already has a real deployment elsewhere (variables.nix's new
deployedTargets, checked by hostName so it also catches cross-platform
duplicates) unless --allow-duplicate-host is passed. --dry-run throughout.

scripts/env.sh centralizes the Proxmox connection config both scripts
(and future ones) share. Also fixes an unrelated gap found along the way:
proxmox-* Disko image builds write their .raw file straight into the
repo root, and .gitignore never covered it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

CLAUDE.md

@@ -62,7 +62,7 @@ There is no test suite — "correctness" here means the flake evaluates and
 sweeps: after editing one or two hosts/modules, evaluate just the
 `nixosConfigurations.<host>` you touched (plus any `config.system.build.tarball`
 /`diskoImagesScript`/package output affected) rather than looping over every
-host — `codex-maintenance.sh` evaluates 19 hosts plus every package/tarball/
+host — `codex-maintenance.sh` evaluates 18 hosts plus every package/tarball/
 image variant now and is slow to run after each small change. Reserve a full
 `codex-maintenance.sh` run for changes that plausibly affect every host
 (`modules/common/*`, `flake.nix`, `variables.nix`) or as a final check before
@@ -70,6 +70,44 @@ committing. This is a session-workflow preference only — it does not apply to
 CI, which should keep running the full script on every push/PR regardless of
 diff size; that's the point of it.
 
+## Scripts
+
+Beyond `codex-setup.sh`/`codex-maintenance.sh` above, `scripts/` also has:
+
+- `scripts/sync-host-keys.sh` — generates/registers SSH host keys and their
+  `.sops.yaml`/`secrets/*.yaml` recipients for flake targets, idempotently
+  (`--all`, `<target>`, `--remove`, `--regenerate-all-keys`, all with
+  `--dry-run`). The primary tool for provisioning a new host's secrets
+  access — see "Creating a new machine" in `docs/auto-installer.md`.
+- `scripts/prepare-host-key.sh` — narrower predecessor: generates a key by
+  an arbitrary name without touching `.sops.yaml`. Still useful to
+  pre-generate a key before its flake target exists yet, since
+  `sync-host-keys.sh` can only act on targets `nixosConfigurations` already
+  has.
+- `scripts/create-proxmox-resource.sh` — builds a `lxc-*`/`proxmox-*`
+  target's tarball/disk image and creates it on a real Proxmox node
+  (`pct restore` / `qm create`+`importdisk`), or reconfigures an existing
+  resource's cores/memory/disk size (`--modify`, always requires typing the
+  VMID back to confirm). Refuses to create a target whose host identity
+  already has a real deployment elsewhere (`variables.nix`'s
+  `deployedTargets`) unless `--allow-duplicate-host` is passed.
+  `--dry-run` throughout both modes.
+- `scripts/env.sh` — shared config (`PROXMOX_HOST`, storage pool, bridge,
+  default cores/memory) sourced by `create-proxmox-resource.sh`. Add new
+  cross-script config here instead of duplicating it per-script.
+- `scripts/bump-nixpkgs-release.sh` — bumps `flake.nix`'s `nixpkgs.url`/
+  `home-manager.url` in place. Exists because flake input URLs can't
+  reference `variables.nix` (confirmed empirically — `nix flake metadata`
+  errors on it), so this is the closest equivalent to a single source of
+  truth for the tracked release.
+
+`sync-host-keys.sh` and `create-proxmox-resource.sh` genuinely mutate real
+state when run for real (not `--dry-run`): real `secrets/*.yaml`
+recipients, real Proxmox VMs/containers. They require the operator's own
+SSH/sops access, which an agent session doesn't have — but don't suggest
+running either non-dry-run without the operator's explicit go-ahead even
+if it becomes technically reachable.
+
 ## Architecture
 
 `flake.nix` is the single entry point. It generates one
@@ -129,6 +167,12 @@ removing a host.
   `lxc-*`). Also carries `imageSize`/`imageName`, letting every `proxmox-*`
   host be built as a standalone, `qm importdisk`-ready `.raw` image with no
   install step — see `docs/proxmox-images.md`.
+- `modules/disko/linode.nix` — `linode-*`'s disko config, deliberately
+  different in kind from the Proxmox one: Linode provisions and sizes
+  `/dev/sda`/`/dev/sdb` itself as whole, unpartitioned devices before the OS
+  boots, so this declares them with `destroy = false` (disko never wipes
+  them) and a bare `filesystem`/`swap` content type instead of a partition
+  table — idempotent against an already-provisioned disk, never destructive.
 - `modules/boot/efi.nix` — systemd-boot + EFI vars, paired with the disko module.
 - `modules/installer/` — the auto-installer environment (ISO, also served as
   PXE netboot): `common.nix` (shared config + the generated