seed.d — per-lane fixture blocks for scripts/go-port/seed-fixtures.sh
=====================================================================

seed-fixtures.sh builds the core fixtures, then sources every *.sh here in
byte order of the file name (lib/seed-d.sh). One file per lane, named
<NN>-<lane>.sh (NN orders the lanes: a block may rely on an earlier one).

Rules
  * PHP code paths only. Create panel objects through the PHP panel's own
    endpoints / scripts, as seed-fixtures.sh does; never INSERT by hand
    (SQL is read-only, to decide whether a fixture already exists).
  * Runs as root on the test VM over SSH, nowhere else. No customer data.
  * Idempotent. Check first; print one line per fixture, either
        exists <what>
        created <what>
    A second seed run must print no `created` line. seed-fixtures.sh counts
    the `created` lines of every block into its final
        seed-fixtures: SUMMARY created=<core + all blocks>
  * The block is sourced in a subshell with `set -euo pipefail`: it can use
    the caller's helpers and variables (say, cred_get, cred_ensure, CREDS,
    ...) but cannot change them. The first block that exits non-zero aborts
    the whole seed and the error names its file; later blocks do not run.
  * Secrets go to /root/go-port/creds via cred_ensure; never print them.
  * What the block creates outside the saved state (containers, OS users,
    the haproxy volume, ...) is covered by the Proxmox snapshot taken after
    the consolidated seed; what is file-level state belongs in
    snapshot-scope.d/<lane>.list so state-snapshot.sh can save and restore it.
  * A lane that needs EXTRA state later does not add a Proxmox snapshot: its
    block runs on top of SEEDED8 and the result is saved as the named restore
    point `<lane>-<what>` (state-snapshot.sh save <name>), listed in
    docs/go-port/test-vm.md and selected by Case.Baseline.
