Add replay-safe fixed lease IDs to the Proxmox provider #1847

Goal

Add replay-safe fixed lease IDs to the direct Proxmox provider so orchestrators can call warmup --lease-id cbx_<12 hex> without weakening duplicate-allocation safeguards.

Current behavior

The Proxmox backend implements ordinary SSH leases, but does not implement IdempotentLeaseIDBackend. A fixed-ID warmup therefore fails before allocation with:

provider=proxmox does not support fixed idempotent lease IDs

The current acquire path generates a new lease ID and asks /cluster/nextid for every create. Proxmox's clone API already accepts an explicit target newid; the missing contract is durable binding and replay reconciliation in the provider.

Architecture decision

Reuse Crabbox's existing fixed-lease framework used by direct providers. Do not use the slug as identity and do not derive a VMID by truncating/hashing the lease ID into an unchecked numeric range.

For a requested fixed lease ID:

1. Persist the normalized create intent and chosen Proxmox VMID before submitting clone.
2. Submit that VMID as the clone API's newid.
3. On identical replay, inspect the persisted binding and exact VMID.
4. Adopt only when provider scope, lease labels, intent fingerprint, VMID, and native vmgenid agree.
5. Reject changed intent or conflicting/multiple resources with lease_id_conflict.
6. Preserve uncertain attempts for recovery instead of allocating another VM.
7. Retain a terminal tombstone after confirmed release/absence so the fixed operation ID is single-use.
8. Keep ordinary non-fixed Proxmox behavior unchanged.

Tests

Use strict test-first development. Cover at minimum:

• fixed-ID support is advertised;
• first fixed acquire persists intent/VMID before clone;
• identical replay returns the same lease without another clone;
• intent drift fails with lease_id_conflict;
• conflicting labels, VMID, provider scope, or vmgenid fail closed;
• ambiguous/missing post-submit state does not issue a second clone;
• release confirms exact identity and retains a terminal tombstone;
• replay after release cannot create another VM;
• ordinary non-fixed warmup remains unchanged;
• no slug-based adoption.

Documentation

Update the Proxmox provider and identifier documentation to list Proxmox among direct fixed-ID providers and describe its exact VMID/generation reconciliation contract.

Non-goals

• No OpenClaw-specific behavior or dependencies.
• No changes to Proxmox itself.
• No deterministic hash-to-VMID shortcut without durable allocation state.
• No weakening of existing cleanup ownership checks.