proxmox-install: reset hard instead of checkout

Regenerated _templ.go files embed the templ source path at runtime,
which differs between the dev machine and /opt/vetting-src on the
target. That left tracked files modified after every build, and the
next upgrade-run hit "local changes would be overwritten by checkout"
and aborted. /opt/vetting-src is script-managed, so `git reset --hard
origin/<branch>` is the right semantics.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

deploy/proxmox-install.sh

@@ -56,7 +56,11 @@ fi
 echo "==> fetching source into ${SRC_DIR}"
 if [[ -d "${SRC_DIR}/.git" ]]; then
     git -C "${SRC_DIR}" fetch --depth=1 origin "${BRANCH}"
-    git -C "${SRC_DIR}" checkout -B "${BRANCH}" "origin/${BRANCH}"
+    # Discard any local mods — the previous build leaves regenerated
+    # _templ.go files with build-dir-dependent strings in them, and
+    # those block a plain checkout. /opt/vetting-src is managed entirely
+    # by this script, so there's nothing here worth preserving.
+    git -C "${SRC_DIR}" reset --hard "origin/${BRANCH}"
 else
     install -d -m 0755 "$(dirname "${SRC_DIR}")"
     git clone --depth=1 --branch "${BRANCH}" "${REPO_URL}" "${SRC_DIR}"