[prop4n]

Templates increment B: create a VM by cloning a declared template, applying
per-clone cloud-init. A single golden template now produces many VMs.

Manifest

fromTemplate on VirtualMachine, a scalar name (full clone) or an object with
linked: true. Mutually exclusive with image; cloud-init is allowed and is the
point of cloning.

spec:
  fromTemplate: debian-12-tpl        # or { name: debian-12-tpl, linked: true }
  cloudInit: { user: debian, ip: dhcp }

Behaviour

• The template name resolves to a vmid from the declared Template manifests;
  an undeclared name is a clear error.
• The clone is deferred until its template is built and converted on the cluster
  (no racing the build).
• Proxmox layer: Clone (full/linked) then finish the VM (cloud-init drive,
  cores/memory/cpu overrides, resize, start).
• The guest reconciler no longer deletes a template's VM while it is still being
  built (VMID owned by a declared Template is skipped).

Verification

• Unit: manifest forms + validation, clone resolution, defer-until-ready,
  half-built-template protection, linked clone, undeclared error, no re-clone.
• End-to-end on a live cluster, driven by the daemon: template built + converted,
  then app-clone cloned from it with cloud-init (user/ip/nameserver), resized, and
  started. The two ordering/ownership bugs above were found and fixed during this
  live run.

golangci-lint (v2), gofmt, Go + vitest suites all green.

Next

Container (LXC) apply; guest disk/NIC drift.