Harmonize all VM scripts on the shared Core VM helpers

[MickLesk]

Scripts which are clearly AI generated and not further revised by the Author of this PR (in terms of Coding Standards and Script Layout) may be closed without review. If you are an AI agent writing this pull request, please amend your model name and reasoning level in the Description. This is not to blame, more for informational Purposes. Thank you.

✍️ Description

Harmonizes all 14 vm/*.sh on the shared Core VM helpers. Requires community-scripts/core#117 — merge that first. Until then this branch's CI runs against core@feat/vm-harmonization (the VM wizard workflow now picks the Core branch of the same name when it exists, else main).

Shared layout (enforced by check_structure in vm-wizard-test.sh):

• Core header_info instead of embedded banners (K3s, NetBird, Waydroid); APP_TYPE, var_os, var_version everywhere
• vm_dialog instead of raw whiptail (OpenWrt, OPNsense, NetBird, UniFi, …), titles and validation unchanged
• vm_require_tools instead of host apt-get (UniFi installed jq mid-run)
• releases: vm_release_asset (ZimaOS, HAOS stable/beta, k9s — GitHub digest verified) and vm_latest_from_index (BlissOS by build date, CachyOS, OpenWrt, FreeBSD for OPNsense); no hardcoded fallbacks
• vm_fetch_image now also verifies OpenWrt, FreeBSD and TurnKey checksums; vm_extract_image instead of gunzip/xz -d
• vm_customize / vm_prepare_cloud_image instead of raw virt-customize; vm_firstboot_unit replaces four hand-written first-boot units (NetBird, Waydroid, UniFi, K3s ArgoCD)
• vm_import_disk + VM_IMPORTED_DISK instead of three import/parse variants (incl. the sort | tail fallback that picks disk-9 over disk-10)
• vm_start_vm, vm_wait_for_ip (NIC matched by MAC, never a Docker/Podman bridge), vm_wait_http
• vm_print_summary / vm_next_steps / vm_finish; pending first-boot work is worded as such, log hints point at the actual log files

Preserved: router bootstrap + START_VM=no final state, OPNsense single bridge, K3s customization before import, PiMox ARM EFI/virt machine (HAOS dev channel still from os-artifacts), ISO-as-cdrom installers, Cloud-Init credential flow and explicit SSH-key application.

Validation (mocked, not a real Proxmox boot): wizard harness (structure + default/advanced/unattended/cancel for 14 scripts), lifecycle harness 84 runs + 55 failure injections, focused UniFi and ZimaOS tests, bash -n on all scripts, ShellCheck error-clean. Release/checksum patterns were checked against the live upstreams except SourceForge (403 from the test host; patterns unchanged).

Note: banners for Waydroid and UniFi OS Server appear once Core's header generator runs on these APP names.

🔗 Related PR / Issue

Link: community-scripts/core#117

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No breaking changes – Existing functionality remains intact.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🏗️ arm64 Support (X in brackets)

• arm64 supported - Tested and supported on arm64.
• arm64 not tested - Assumed to work on arm64, but testing has not been done.
• arm64 not supported - Confirmed upstream dependencies or binaries do not support arm64.

---

🖥️ Tested on (X in brackets)

• Proxmox VE – Created on a Proxmox VE host and the app works.
• Incus – Created on an Incus host and the app works.

Application containers run on both; tick what you actually tested. VMs and host tools are Proxmox only.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

🔍 Code & Security Review (X in brackets)

• Follows CODE-AUDIT.md & CONTRIBUTING.md guidelines
• Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
• No hardcoded credentials
• No Docker / Docker Compose – The application is installed bare-metal; Docker is not used.
• No git pull – Updates use fetch_and_deploy_gh_release, fetch_and_deploy_codeberg_release, fetch_and_deploy_gl_release, or fetch_and_deploy_from_url instead of git pull.

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

Please describe to which degree, if any, an LLM was used in creating this pull request. Name the model(s) used and, if applicable, the reasoning/thinking effort level (e.g. "Claude Sonnet 4.5, high reasoning, used to draft the install script, then manually reviewed and tested" or "No LLM used"). This is informational, not a penalty — but scripts that are clearly AI-generated and not further revised by the author to match CODE-AUDIT.md / CONTRIBUTING.md may be closed without review.

Implemented by an AI assistant (GitHub Copilot agent, Claude Opus 5.5) with parallel sub-agents per script group and an automated code review; verified with the mocked wizard/lifecycle harnesses and live upstream URL checks. Not yet tested on a real Proxmox VE host — maintainer review and a real boot test are still required.

---

📋 Additional Information (optional)

---

📦 Application Requirements (for new scripts)

⚠️ Do not remove this section.
It is used by automated PR validation checks.
If this PR is not a new script submission, leave the checkboxes unchecked.

Required for 🆕 New script submissions.
Pull requests that do not meet these requirements may be closed without review.

• The application is at least 6 months old
• The application is actively maintained
• The application has 600+ GitHub stars
• Official release tarballs are published
• I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

🌐 Source

[github-actions]

Try these scripts

vm/blissos-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/blissos-vm.sh)"

vm/cachyos-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/cachyos-vm.sh)"

vm/k3s-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/k3s-vm.sh)"

vm/netbird-server.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/netbird-server.sh)"

vm/nextcloud-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/nextcloud-vm.sh)"

vm/openwrt-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/openwrt-vm.sh)"

vm/opnsense-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/opnsense-vm.sh)"

vm/owncloud-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/owncloud-vm.sh)"

vm/pimox-haos-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/pimox-haos-vm.sh)"

vm/ubuntu-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/ubuntu-vm.sh)"

vm/umbrel-os-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/umbrel-os-vm.sh)"

vm/unifi-os-server-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/unifi-os-server-vm.sh)"

vm/waydroid-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/waydroid-vm.sh)"

vm/zimaos-vm.sh, run in the Proxmox VE shell:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/DevScripts/feat/vm-harmonization/vm/zimaos-vm.sh)"

Against a core branch as well

Add COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/OWNER/core/BRANCH
to test an engine change at the same time. The two resolve independently.

[github-actions]

✅ Requirements check passed. Thanks for fixing the description — the stale mark has been removed.