v0.63.0: B3+B2 fresh-install fixes — TokenStore reload-on-miss + guesthook snippets dir

B3: Lookup re-reads the append-only store once on a miss (cross-process
coherence with the one-shot provisioner; size short-circuit bounds the cost;
behind the TokenAuthority seam). B2: fenced mkdir -p /var/lib/vz/snippets
before the snippet install + the one narrow sudoers grant. Both red-proofed;
drill findings DRILL-day0-cleanroom-2026-07-03 B3/B2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/guesthook/install.go

@@ -53,6 +53,13 @@ func InstallSnippet(ctx context.Context, runner proxmox.Runner) error {
 	if err := f.Close(); err != nil {
 		return fmt.Errorf("guesthook: close temp snippet: %w", err)
 	}
+	// Ensure the snippets dir exists FIRST (B2, DRILL-day0-cleanroom-2026-07-03): a fresh PVE has
+	// no /var/lib/vz/snippets, and `install` (without -D) won't create the parent — the whole
+	// hook install silently failed on a freshly-bootstrapped box. Fenced root op like the install
+	// itself; idempotent.
+	if _, stderr, err := runner.Run(ctx, "mkdir", "-p", SnippetDir); err != nil {
+		return fmt.Errorf("guesthook: ensure snippets dir %s: %w: %s", SnippetDir, err, string(stderr))
+	}
 	if _, stderr, err := runner.Run(ctx, "install", "-m", "0755", "--", tmp, SnippetPath); err != nil {
 		return fmt.Errorf("guesthook: install snippet to %s: %w: %s", SnippetPath, err, string(stderr))
 	}