Add sync-host-keys.sh and create-proxmox-resource.sh

sync-host-keys.sh: generates/registers SSH host keys and their
.sops.yaml/secrets/*.yaml recipients for flake targets, idempotently.
--all, <target>, --remove, --regenerate-all-keys, all with --dry-run
(verified zero-side-effect via a sandboxed git-status check across every
mode). Only ever touches anchors with a corresponding host-keys/ file --
&admin and any hand-registered real-host anchor are never listed,
removed, or regenerated. Supersedes running prepare-host-key.sh one host
at a time for any target that already has a flake entry.

create-proxmox-resource.sh: builds a lxc-*/proxmox-* target's
tarball/disk image and creates it on a real Proxmox node, or reconfigures
an existing resource's cores/memory/disk (--modify, always requires
typing the VMID back to confirm). Refuses to create a new resource for a
VMID that already exists, and refuses to duplicate a host identity that
already has a real deployment elsewhere (variables.nix's new
deployedTargets, checked by hostName so it also catches cross-platform
duplicates) unless --allow-duplicate-host is passed. --dry-run throughout.

scripts/env.sh centralizes the Proxmox connection config both scripts
(and future ones) share. Also fixes an unrelated gap found along the way:
proxmox-* Disko image builds write their .raw file straight into the
repo root, and .gitignore never covered it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

docs/proxmox-images.md

@@ -7,6 +7,12 @@ config (`modules/disko/proxmox.nix`) already used to format a real disk on
 install, so there's nothing host-specific to write; it's available for every
 `proxmox-*` target automatically.
 
+`scripts/create-proxmox-resource.sh --type vm --host <name>` automates the
+whole walkthrough below (and the equivalent LXC one) end to end, including
+host-key handling and upload — see its `--help`. The steps here are what it
+runs under the hood, useful for doing any of it by hand or understanding
+what it does before you trust it against real infrastructure.
+
 ## Building
 
 ```sh
@@ -43,9 +49,10 @@ sudo ./result \
   --build-memory 2048
 ```
 
-Generate the key first with `scripts/prepare-host-key.sh <hostname>`, same
-as any other host — see `docs/auto-installer.md` for the full sops.yaml
-registration walkthrough.
+Generate the key first with `scripts/sync-host-keys.sh <hostname>`, same
+as any other host — see `docs/auto-installer.md` for the full walkthrough
+(it registers the new key in `.sops.yaml` and re-encrypts the affected
+`secrets/*.yaml` files too, no manual editing needed).
 
 ## Deploying to Proxmox