QoL: message blocks, clean-install keep list, password helper, network limits - #61

✍️ Description

Four independent fixes, one per function. None changes an existing call site.

msg_block_resume / msg_info / msg_ok (core/core.func)
msg_info pushes onto a block stack, msg_ok pops and restarts the spinner for whatever is underneath. A helper that opens its own block — setup_uv, setup_nodejs, fetch_and_deploy* — used to stop the outer block's spinner with nothing bringing it back, so the outer msg_ok reported on a step that had been invisible since. msg_warn/msg_error clear the stack, as they already killed the spinner. A msg_ok without a matching msg_info does not underflow.

random_password [length] (core/core.func)
Alphanumeric, exact length, default 24. Replaces openssl rand -base64 N | tr -dc … | head -c N, which returns fewer characters than asked for because the filter runs after the length is fixed, and takes a SIGPIPE under pipefail. Base64 also carries / and +, which break the DSN and URL strings these values get pasted into. Hex tokens are unaffected and stay as they are.

_cs_clean_target_dir (lib/forge.func)
New CLEAN_INSTALL_KEEP: space-separated paths relative to the target that survive a CLEAN_INSTALL=1 wipe. Moved aside and back rather than pruned from find — a kept path can be nested, and removing its parent would take it along; mv also keeps a symlink a symlink, which is the case that prompted this. Behaviour with the variable unset is unchanged.

_cs_write_cargo_net, setup_uv, setup_composer (lib/runtime.func)
Network limits for the remaining package managers, matching what pnpm and yarn already got: cargo [net] retry = 5 (appended, an existing config survives), UV_HTTP_TIMEOUT=600 (uv has no config key, only the env var), composer process-timeout 600 on both install paths.

🔗 Related Issue

Fixes #

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected (Proxmox VE and/or Incus, as applicable).
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
• API.txt regenerated – If a function signature or behavior changed, API.txt was updated to match.

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any code in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Code was written without AI assistance.
• AI was used – The output has been reviewed and corrected, and I take responsibility for it matching this repo's conventions.

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing behavior in a way that may require updates in every downstream script.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, docs/, CONTRIBUTING.md, or other docs.