test(validation): route post-deploy ops through guest agent for 2FA

secharden-2fa enforces AuthenticationMethods publickey,keyboard-
interactive, so once setup completes no non-interactive SSH client can
authenticate (a TOTP token is required). The harness's post-deploy steps
— log fetch, repo path resolution, and the validation suite — all relied
on SSH and therefore failed after the first successful deploy, masking
the fact that setup itself had completed (rc=0).

- remote.sh: add a vm-guest mode that runs commands as root inside the
  VM via the Proxmox qemu-guest-agent (qm guest exec), bypassing SSH/2FA
  entirely. Output is parsed on the Proxmox host with python3.
- vm-validation.sh: resolve repo path, fetch the setup log, and run the
  validation suite via vm-guest when SSH is unavailable. Detect the
  setup exit marker from the always-available live stream as a fallback
  to the fetched log. Make restore_vm_access 2FA-aware so a post-deploy
  SSH failure is understood (not a hard error) once 2FA is in effect.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

Project-Tests/remote.sh

@@ -30,6 +30,8 @@ PROX_HOST="${PROX_HOST:-pfv-tsys5}"
 PROX_USER="${PROX_USER:-root}"
 VM_IP="${VM_IP:-192.168.3.50}"
 VM_USER="${VM_USER:-localuser}"
+VM_ID="${VM_ID:-}"
+GUEST_TIMEOUT="${GUEST_TIMEOUT:-900}"
 
 SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
 
@@ -53,6 +55,33 @@ _copy() {
   fi
 }
 
+# Out-of-band VM access via the Proxmox qemu-guest-agent. This runs commands
+# as root inside the VM and does NOT depend on SSH, so it works even after
+# secharden-ssh replaces authorized_keys and secharden-2fa enforces
+# publickey+keyboard-interactive (which blocks non-interactive SSH).
+GUEST_PARSER="/root/.knel-guest-parse.py"
+GUEST_PARSER_SRC="import sys, json
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    sys.exit(3)
+sys.stdout.write(d.get('out-data', '') or '')
+sys.stderr.write(d.get('err-data', '') or '')
+ec = d.get('exitcode', 1)
+sys.exit(ec if ec is not None else 1)"
+
+_ensure_guest_parser() {
+  if _prox "test -f '$GUEST_PARSER'" >/dev/null 2>&1; then return 0; fi
+  printf '%s\n' "$GUEST_PARSER_SRC" | _prox "cat > '$GUEST_PARSER'" >/dev/null 2>&1
+}
+
+_vm_guest() {
+  [ -n "$VM_ID" ] || die "vm-guest requires VM_ID"
+  _ensure_guest_parser
+  local cmdb64; cmdb64="$(printf '%s' "$*" | base64 -w0)"
+  _prox "qm guest exec $VM_ID --timeout ${GUEST_TIMEOUT} -- /bin/sh -c 'echo $cmdb64 | base64 -d | /bin/sh' 2>/dev/null | python3 '$GUEST_PARSER'"
+}
+
 mode="${1:-}"; shift || true
 case "$mode" in
   prox)         [ "$#" -ge 0 ] || die "need command"; _prox "$*" ;;
@@ -62,6 +91,7 @@ case "$mode" in
   vm-file)      [ -f "${1:-}" ] || die "need local script file"; _vm "bash -s" < "$1" ;;
   vm-copy)      [ -f "${1:-}" ] || die "need local file"; _copy "${VM_USER}@${VM_IP}" "$1" "${2:-}" ;;
   prox-copy)    [ -f "${1:-}" ] || die "need local file"; _copy "${PROX_USER}@${PROX_HOST}" "$1" "${2:-}" ;;
+  vm-guest)     [ "$#" -ge 1 ] || die "need command"; _vm_guest "$*" ;;
   ""|-h|--help|help) sed -n '2,40p' "${BASH_SOURCE[0]}" >&2; exit 0 ;;
   *) die "unknown mode '$mode'. Run '$0 help'." ;;
 esac