Changelog 2026-07-12 -- DOCFIX-187: opnsense-edge module first-boot fixes (boot still OPEN)

Context. First real boot of the Office1 OPNsense edge. Several correct-but-necessary module fixes were made while debugging; the boot is NOT yet resolved (a BTX-loader triple-fault remains -- see docs/incident-20260712-opnsense-edge-boot-triplefault.md). These changes are kept because a working config needs them regardless.

opentofu/modules/opnsense-edge/main.tf

1. Serial console added (devices.serials, file-backed to /var/lib/libvirt/vr1/staging/${vm_name}-serial.log). OPNsense nano is serial-only; the module had no console, so the guest had no output and faulted with nothing to show. This got the boot from a blank early fault to the loader stage (and gives boot-log capture).
2. machine q35 -> pc (i440fx). FreeBSD's legacy BTX loader is far more commonly booted on i440fx; q35 is a known early-fault source. (Did not fix this incident, but is the safer, documented choice.)
3. Disk: COW overlay -> direct per-VM copy (create.content.url = base_volume_path, no backing_store). Matches the documented virt-install --import <nano.qcow2> flow; the nano is designed to boot + auto-expand in place, not through a read-only backing. var.disk_size_bytes is now unused (nano is pre-grown by opnsense-prep-image.sh).
4. CPU host-passthrough with AMD svm disabled (cpu.features = [{name=svm, policy=disable}]). The documented AMD nested-virt fix (-cpu host,-svm). NOTE: the provider key is features (plural) -- feature validates but is silently dropped.

Important operational note discovered

• machine and cpu are create-time; the dmacvicar provider plans them as an in-place "change" that libvirt does NOT apply to an existing domain. To actually change them: virsh destroy <dom>; virsh undefine <dom>; tofu apply (recreate). tofu apply -replace hit "domain already exists" mid-replace this session.

Status

• Module tofu validate -> Success. NOT booting: OPNsense triple-faults at the BTX loader regardless of the above (incident report has the full trail + ranked next steps).

Revert

• git checkout opentofu/modules/opnsense-edge/main.tf to the pre-DOCFIX-187 revision. (Reverts the serial console + i440fx + direct-disk + svm-disable together.)