feat(clusters): key for_each by host, validate hostname uniqueness (#68, #69)

[jfreed-dev]

Two v1.7.0 (#67) follow-ups for talos-cluster and k3s-cluster, both milestoned v1.8.0.

#69 — key for_each by host, not list index (bug)

The per-node resources keyed for_each positionally:

• Talos: talos_machine_configuration_apply.{controlplane,worker}
• K3s: null_resource.{k3s_workers,bootstrap_ssh_workers}, data.tls_public_key.workers_bootstrap

Removing/reordering a node shifted every later index, so Terraform re-targeted the surviving instances at a different host — re-pushing Talos machine config (which a live node rejects with static hostname already set) or re-running the K3s install provisioners. Now keyed by the stable node.host; the Talos local.hostname_patches map is host-keyed to match.

All index-keyed worker for_each blocks in k3s were re-keyed together (not just the install one) so they stay consistent.

#68 — plan-time hostname uniqueness (enhancement)

A duplicate non-blank hostname across control_plane + workers made two nodes register under the same Talos/Kubernetes node identity (kubelet collision, one node shadows the other) with no plan-time signal. A resource lifecycle precondition now fails terraform plan naming the duplicate. Null/empty/whitespace stay exempt.

precondition is the lightest mechanism that actually fails the plan — check {} only warns, cross-variable validation needs TF >= 1.9 — so required_version is raised >= 1.0 → >= 1.2 in both modules.

⚠️ Migration (existing deployments)

Instance addresses change (…["0"] → …["10.10.88.73"]). Existing state must be re-mapped once with tofu state mv before the next apply, or Terraform destroys/recreates the apply resources against live nodes. Per-module recipes are in each README ("Upgrading from < v1.8.0") and docs/UPGRADE.md. moved {} blocks can't ship in a reusable module — the index→host mapping depends on the consumer's node list/order.

Validation

tofu validate + tofu fmt -check pass on both modules. Offline tofu plan confirms:

• duplicate hostnames → plan fails with the named-duplicate precondition message (both modules)
• unique + blank hostnames → plan succeeds, resources keyed by host (…["10.0.0.1"])

Docs

• Both module READMEs: Requirements table >= 1.2, uniqueness note, "Upgrading from < v1.8.0" state-mv recipe
• docs/UPGRADE.md: new ### v1.8.0 Breaking Changes entry
• Root README prerequisite >= 1.2
• CHANGELOG.md: ## [1.8.0] entry (+ restored the missing 1.7.0–1.7.2 compare links)

Closes #68
Closes #69