Inject PROXMOX_SSH_PRIVATE_KEY and ADMIN_SSH_PUBLIC_KEY secrets as TF_VAR_ environment variables for CI.
- Separate workflow for pull_request events only - No Apply job visible in PR checks - Simplified checkout using gitea.head_ref directly Refs #3