Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC

[MickLesk]

Shared helpers so DevScripts VM scripts stop hand-rolling the same steps (and the same bugs).

New vm/common.func (loaded by pve/vm-core.func and incus/vm-core.func, prefetched by core/build.func):

• vm_require_tools – install missing host tools up front (one apt call) or stop before anything is created
• vm_customize – named virt-customize step that warns with libguestfs' reason and returns failure
• vm_release_asset – GitHub/GitLab/Codeberg release asset via lib/forge.func (token, rate limit, API-less fallback); exposes GitHub's asset digest as VM_RELEASE_SHA256
• vm_latest_from_index – newest entry of an HTML index (--sort-by, --probe templates), never a hardcoded fallback
• vm_firstboot_unit – run-once systemd unit with Cloud-Init-aware ordering (no multi-user/cloud-final cycle) and a success marker
• vm_wait_http, vm_print_summary, vm_next_steps, vm_finish – standard readiness check and closing block

pve/vm-core.func

• vm_import_disk – qm disk import/importdisk, returns the volume Proxmox reported or the new unusedN; fixes the pvesm list | sort | tail fallback picking disk-9 over disk-10
• vm_start_vm, vm_wait_guest_agent, vm_guest_exec, vm_wait_for_ip (Incus: explicit exit 119)
• checksum discovery now covers OpenWrt sha256sums, FreeBSD CHECKSUM.SHA256, TurnKey .hash (GNU/BSD/bare layouts) plus vm_fetch_image --checksum-url

vm/cloud-init.func

• get_vm_ip <vmid> [timeout] [mac] matches the NIC by MAC and skips docker/podman/CNI/link-local addresses
• wait_for_cloud_init uses the guest agent (cloud-init status --wait) before SSH

pve/vm-app.func uses the shared download, import, tool and IP helpers instead of its own copies (its import swallowed failures).

Tests: new tests/vm-helpers.sh (39 cases, added to Verify split files); tests/vm-iso-storage.sh and tests/vm-consoles.sh unchanged and passing; ShellCheck error-clean. Docs: docs/vm.md, docs/backends.md, docs/README.md.

DevScripts counterpart (all VM scripts migrated) follows on the branch of the same name, whose CI runs against this branch.

[github-actions]

Try this branch

The engine and the scripts resolve independently, so a production script can
be run against the engine from this PR by setting one variable:

COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/community-scripts/core/feat/vm-harmonization \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/debian.sh)"

Swap ct/debian.sh for whatever exercises the change.

This PR touches both backends. Worth running on a Proxmox VE and an Incus host.

Run a script from a fork as well

curl -fsSL https://raw.githubusercontent.com/community-scripts/core/feat/vm-harmonization/tools/run.sh |
  bash -s -- https://raw.githubusercontent.com/YOU/DevScripts/your-branch ct/debian.sh \
             https://raw.githubusercontent.com/community-scripts/core/feat/vm-harmonization

Note that run.sh is reached through a pipe, so the script it starts inherits
an exhausted stdin. Whiptail is fine — it opens /dev/tty — but a plain read
would see EOF. The single-variable form above does not have that problem.

Useful flags while testing

dev_mode=net logs every engine fetch with status and duration, which is the
quickest way to confirm the branch is really being used. dev_mode=keep stops a
failed build from deleting the container along with the evidence.