refactor: simplify homelab bootstrap around static IPs and fresh runs

Make Terraform the source of truth for node IPs, remove guest-agent/SSH discovery from the normal workflow path, simplify the bootstrap controller to a fresh-run flow, and swap the initial CNI to Flannel so cluster readiness is easier to prove before reintroducing more complex reconcile behavior.

.gitea/workflows/kubeadm-reset.yml

@@ -103,25 +103,9 @@ jobs:
       - name: Create kubeadm inventory
         env:
           KUBEADM_SSH_USER: ${{ secrets.KUBEADM_SSH_USER }}
-          KUBEADM_SUBNET_PREFIX: ${{ secrets.KUBEADM_SUBNET_PREFIX }}
         run: |
           set -euo pipefail
-          TF_OUTPUT_JSON=""
-          for attempt in 1 2 3 4 5 6; do
-            echo "Inventory render attempt $attempt/6"
-            TF_OUTPUT_JSON="$(terraform -chdir=terraform output -json)"
-            if printf '%s' "$TF_OUTPUT_JSON" | ./nixos/kubeadm/scripts/render-inventory-from-tf-output.py > nixos/kubeadm/scripts/inventory.env; then
-              exit 0
-            fi
-
-            if [ "$attempt" -lt 6 ]; then
-              echo "VM IPv4s not available yet; waiting 30s before retry"
-              sleep 30
-            fi
-          done
-
-          echo "Falling back to SSH-based inventory discovery"
-          printf '%s' "$TF_OUTPUT_JSON" | ./nixos/kubeadm/scripts/discover-inventory-from-ssh.py > nixos/kubeadm/scripts/inventory.env
+          terraform -chdir=terraform output -json | ./nixos/kubeadm/scripts/render-inventory-from-tf-output.py > nixos/kubeadm/scripts/inventory.env
 
       - name: Run cluster reset
         run: |