Render and validate Talos machine configs in CI (secret-free on PRs)

[kelchm]

Summary

The talos CI job runs only talhelper validate talconfig — schema validation. A bad patch merge (e.g., the strategic-merge interface replacement in talos/patches/k8s-prod-N/network-extras.yaml) or an invalid VolumeConfig/UserVolumeConfig field passes CI and surfaces only during a manual task talos:generate-config, possibly mid-rollout. talhelper genconfig is never exercised in CI.

Additionally, each node's primary networkInterfaces block in talconfig.yaml is atomically replaced by the per-node patch, which restates it identically today — two sources of truth where the patch silently wins on divergence, with no CI signal.

Proposed work

• PR job (secret-free, per repo policy — docs/repository-validation.md forbids SOPS keys on PR jobs): generate an ephemeral fixture secret via talhelper gensecret, run talhelper genconfig against talconfig.yaml + patches, and validate each node output with talosctl validate --mode metal.
• Assert generated Kubernetes/Talos versions match talenv.yaml.
• Add a lint asserting .nodes[].networkInterfaces is absent from talconfig.yaml (or equivalent rendered-field assertion), making the per-node patches the single interface source of truth.
• Optional trusted-main job: render with the real decrypted talsecret.sops.yaml, scoped like the existing SOPS push gate.

Acceptance criteria

• A malformed patch or invalid machine-config field fails CI with a clear error.
• Version drift vs talenv.yaml fails CI.
• The interface single-source assertion is enforced; talconfig.yaml no longer shadows the patches.
• PR jobs receive no SOPS key material.

Related

• Prevent Talos apply from using stale generated configuration #293 (held; apply-time staleness guard — this is the PR-time complement)