SPAM: [RFC PATCH 0/4] lxc: add safe OCI rootfs replacement

[copystring <copystring@gmail.com>]

This RFC adds an explicit rootfs replacement path for stopped LXC containers
created from OCI images. The intent is to support the common "refresh the OCI
image" workflow without pretending that data stored inside the old rootfs can be
merged safely.

The safety model is intentionally conservative:

* require an explicit confirmation parameter;
* only operate on stopped, non-template, non-HA, unprotected CTs without
  snapshots or pending config changes;
* only replace the active rootfs volume, while preserving mpX mount points;
* keep the previous rootfs as an unusedX volume instead of deleting it;
* fail if no unusedX slot is available;
* never remove the newly allocated rootfs once config writing has started;
* do not use overlayfs or path heuristics such as /config or /data detection;
* reject shrink-like requests by requiring the target size to be at least the
  current rootfs size.

This means data that only exists on / becomes data on the old unused volume, not
on the new active rootfs. Users are expected to keep persistent application data
on separate mount points or to have a backup before replacing the rootfs.

By default, the endpoint also updates OCI-derived runtime config such as
entrypoint, environment, ostype, arch and OCI-generated lxc keys. A caller can
set update-oci-config=0 to preserve the existing runtime config and only switch
the rootfs.

The pve-manager GUI and pve-docs changes are kept as separate repository series,
but they are part of the same proposed workflow: the UI exposes the destructive
operation behind a confirmation dialog, and the docs describe exactly which data
is preserved and which is not.

Tested on a disposable PVE 9.2.2 VM:

* make -C src check
* make -C /root/proxmox-dev/pve-container clean deb
* API tests cover 24 rootfs replacement subtests, including confirmation,
  non-OCI archives, stopped-only and protected/template/HA/snapshot/pending
  guards, no free unused slot, missing/unmanaged/foreign-owned rootfs, target
  storage without rootdir content, shrink requests, zero/one/multiple mpX mount
  point preservation, update-oci-config=0, prepare failures, fork failures and
  write_config failure handling without deleting the new rootfs.
copystring (4):
  lxc: create: add isolated OCI rootfs preparation
  api: lxc: add OCI rootfs replacement endpoint
  pct: add OCI rootfs replacement command
  test: cover OCI rootfs replacement API transaction

 src/PVE/API2/LXC.pm                      | 300 ++++++++++++++
 src/PVE/CLI/pct.pm                       |   8 +
 src/PVE/LXC/Create.pm                    |  95 +++++
 src/test/Makefile                        |   4 +-
 src/test/api-oci-rootfs-replace-test.pm  | 486 +++++++++++++++++++++++
 src/test/oci-rootfs-replace-test.pm      | 250 ++++++++++++
 src/test/run_oci_rootfs_replace_tests.pl |  10 +
 7 files changed, 1152 insertions(+), 1 deletion(-)
 create mode 100644 src/test/api-oci-rootfs-replace-test.pm
 create mode 100644 src/test/oci-rootfs-replace-test.pm
 create mode 100644 src/test/run_oci_rootfs_replace_tests.pl

-- 
2.55.0.windows.2