add Proxmox Terraform infrastructure backlog

TODO.md

@@ -136,6 +136,32 @@ still needs a clean kube-proxy-free cluster validation.
 - [ ] Add validation that the cloud host exposes the CPU features required by
   Falco and modern eBPF.
 
+## Priority 5a: Proxmox Terraform infrastructure path
+
+- [ ] Add `terraform/proxmox/` using the `bpg/proxmox` provider.
+  - [ ] Pin a reviewed provider version and document the Proxmox VE version
+    compatibility assumptions.
+  - [ ] Use `proxmox_virtual_environment_vm`, not the provider's experimental
+    `proxmox_vm` resource.
+  - [ ] Define provider endpoint, API token, TLS behavior, and SSH agent access
+    through variables or environment variables only.
+  - [ ] Download or reference the pinned Flatcar Proxmox image with checksum
+    verification.
+  - [ ] Upload an Ignition user-data snippet to Proxmox storage with the
+    `snippets` content type enabled.
+  - [ ] Provision the Flatcar k3d test host with configurable VM ID, node,
+    storage, bridge, CPU, memory, and disk size.
+  - [ ] Set CPU passthrough so Falco and modern eBPF workloads receive the
+    required instruction set.
+  - [ ] Keep the Gitea runner VM optional and disabled by default.
+  - [ ] Keep all runner registration tokens and webhook values outside
+    Terraform configuration and state.
+  - [ ] Emit Ansible inventory data or outputs for the created host addresses.
+  - [ ] Add a documented `terraform apply` followed by the Ansible bootstrap.
+  - [ ] Add safe destroy, import, and image rotation guidance.
+  - [ ] Document the required Proxmox storage content types, API permissions,
+    SSH access, and node prerequisites.
+
 ## Priority 6: Documentation and portfolio evidence
 
 - [ ] Update the root README after each automation milestone.