feat(os): profils Proxmox/RPi + machine_probe + proxy persistent (tâche 2 SJ-7)

- templates proxmox/ (update-analyze: dépôts PVE ; full-upgrade) et raspbian/
  (update-analyze: espace disque ; full-upgrade)
- execute résout les actions APT par profil OS (resolveTemplate) → proxmox/
  raspbian si dispo, sinon fallback apt/ (non-régression debian/ubuntu vérifiée)
- machine_probe (lecture seule) : template + parseProbe/proposeCorrections (TDD)
  → propose os_family/machine_kind/virtualization, persiste machine_hardware,
  n'applique jamais auto ; branche execute + allowlist route
- apt_proxy_persistent : ActionType + template idempotent (/etc/apt/apt.conf.d/
  01proxy, backup) + TemplateVars.aptProxyUrl + allowlist route

tsc 0 · 95 tests · build OK · résolution OS vérifiée.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/raspbian/full-upgrade.sh.tpl

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Raspberry Pi OS : full-upgrade (apt) après contrôle d'espace disque. Capture diff dpkg.
+export LC_ALL=C
+export DEBIAN_FRONTEND=noninteractive
+{{#aptProxy}}export http_proxy="{{aptProxy}}"; export https_proxy="{{aptProxy}}"
+{{/aptProxy}}
+echo "===SU:DISK==="
+df -Pk / 2>/dev/null | awk 'NR==2{print "ROOT_AVAIL_KB="$4"\nROOT_USE_PCT="$5}'
+echo "===SU:DPKG_BEFORE==="
+dpkg-query -W -f='${binary:Package}\t${Version}\t${Architecture}\n' 2>/dev/null
+echo "===SU:APT_FULLUPGRADE==="
+apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold full-upgrade 2>&1
+CODE=$?
+echo "===SU:DPKG_AFTER==="
+dpkg-query -W -f='${binary:Package}\t${Version}\t${Architecture}\n' 2>/dev/null
+echo "===SU:REBOOT==="
+if [ -f /run/reboot-required ] || [ -f /var/run/reboot-required ]; then echo "REBOOT_REQUIRED=1"; else echo "REBOOT_REQUIRED=0"; fi
+echo "===SU:EXIT=${CODE}==="

templates/raspbian/update-analyze.sh.tpl

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Raspberry Pi OS : refresh + simulations + held + reboot-check + espace disque (carte SD).
+# Non destructif. rpi-update volontairement NON utilisé (risqué).
+export LC_ALL=C
+export DEBIAN_FRONTEND=noninteractive
+{{#aptProxy}}export http_proxy="{{aptProxy}}"; export https_proxy="{{aptProxy}}"
+{{/aptProxy}}
+
+echo "===SU:DISK==="
+# Espace libre sur / en Ko (carte SD souvent petite) → le backend peut avertir avant upgrade.
+df -Pk / 2>/dev/null | awk 'NR==2{print "ROOT_AVAIL_KB="$4"\nROOT_USE_PCT="$5}'
+
+echo "===SU:APT_UPDATE==="
+apt-get update -qq 2>&1
+UPD=$?
+
+echo "===SU:APT_SIM_UPGRADE==="
+apt-get -s -y upgrade 2>&1
+
+echo "===SU:APT_SIM_DISTUPGRADE==="
+apt-get -s -y dist-upgrade 2>&1
+
+echo "===SU:APT_HELD==="
+apt-mark showhold 2>/dev/null
+
+echo "===SU:REBOOT==="
+if [ -f /run/reboot-required ] || [ -f /var/run/reboot-required ]; then
+  echo "REBOOT_REQUIRED=1"
+  [ -f /var/run/reboot-required.pkgs ] && sed 's/^/PKG=/' /var/run/reboot-required.pkgs
+else
+  echo "REBOOT_REQUIRED=0"
+fi
+
+echo "===SU:EXIT=${UPD}==="