[modem7]

What

PR 3 of the series. Stacked on #53 (base branch verify-from-shared-conf, which is stacked on #52). Merge #52, then #53, then this; GitHub retargets each time.

build-templates.sh can now verify each template right after building it:

./build-templates.sh extras --verify --send-test-mail you@example.com
./build-templates.sh all --verify --keep

• --verify: after each successful build, runs verify-clone.sh <new-vmid> --profile <target> --config <shared.conf>. Output is live.
• --send-test-mail <addr> and --keep are passed on. Both are refused without --verify; --verify is refused with --generate-only.
• The new VMID is found by comparing qm list before and after the build. Exactly one new ID is the template. Zero or several: a warning, that template is skipped and counted as a failure. The create script's output is not parsed.
• Checked before any build starts: verify-clone.sh, verify-template.sh and qm are present, so a long build is not wasted. VERIFY_CLONE overrides the path.
• A failed verify does not stop the other targets. At the end there is a summary (target, VMID, kept clone, result) and the exit code is non-zero if any build or verify failed. Ctrl-C or kill during a verify stops the run after the summary.
• With --keep the summary lists the kept clones and says to remove them with qm destroy <id> --purge.
• Only --config <path> goes on the verify command line; no secrets.

README and --help updated.

Behaviour change: --verify, --keep and --send-test-mail placed after a target are now taken by the builder. The create script has none of these options, so nothing that worked before is lost.

Testing

bash -n and shellcheck are clean. Run against stubs and a mocked qm:

• extras --verify, all --verify with a failing second verify, a failing second build, zero or two new VMIDs, a failing qm list, --keep with all, an exit 130 from verify, and every refusal case.
• Without --verify, the new script and the previous one give the same create-script calls, output and exit codes.
• The real verify-clone.sh was run against the mock qm once to check it integrates.

Not tested: the real qm list output on Proxmox (the first field is taken, with leading spaces tolerated), a real Ctrl-C reaching the builder, and a real build plus verify on a host.