fix: parse terraform output JSON robustly in enroll step

Handle setup-terraform wrapper prefixes by decoding from first JSON object before reading VM outputs.

.gitea/workflows/terraform-apply.yml

@@ -108,8 +108,11 @@ jobs:
           if not token_id or not token_secret:
               raise SystemExit("Missing Proxmox token id/secret")
 
-          with open("tfoutputs.json", "r", encoding="utf-8") as f:
-              outputs = json.load(f)
+          raw_outputs = open("tfoutputs.json", "rb").read().decode("utf-8", "ignore")
+          start = raw_outputs.find("{")
+          if start == -1:
+              raise SystemExit("Could not find JSON payload in terraform output")
+          outputs = json.JSONDecoder().raw_decode(raw_outputs[start:])[0]
 
           targets = []
           for output_name in ("alpaca_vm_ids", "llama_vm_ids"):