fix: migrate /etc/pve/nodes/<old>/ before reboot in set_hostname

After renaming /etc/hostname, Proxmox boots under the new node name and
looks for VM/CT configs in /etc/pve/nodes/<new>/qemu-server/. Without
migrating the directory first, all VMs appear missing after the reboot.

Now renames /etc/pve/nodes/<old>/ to /etc/pve/nodes/<new>/ while
pve-cluster is running (pmxcfs supports live rename). Also replaces
pvecm updatecerts -f with pvenode cert create --overwrite — pvecm
updatecerts restarts pve-cluster, unmounts /etc/pve and can crash VMs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

napalm_proxmox/system_mixin.py

@@ -622,8 +622,10 @@ class ProxmoxSystemMixin:
            installed.
         5. Runtime hostname  — applied immediately via ``hostname(1)`` so SSH
            and the Proxmox API see the new name without a reboot.
-        6. Proxmox node TLS certificate — regenerated via
+        6. ``/etc/pve/nodes/<old>`` → ``/etc/pve/nodes/<new>`` rename so
-           ``pvecm updatecerts -f``.
+           VM/CT configs are found after the reboot under the new node name.
+        7. Proxmox node TLS certificate — regenerated via
+           ``pvenode cert create --overwrite``.
 
         **Important**: the Proxmox *node name* (shown in the web UI and stored
         in ``/etc/pve/nodes/<name>/``) only changes after a full reboot.
@@ -692,14 +694,35 @@ class ProxmoxSystemMixin:
         # ── 5. Apply hostname at runtime ─────────────────────────────────
         self._exec_ssh_command(f"hostname '{short_hostname}'")
 
-        # ── 6. Regenerate Proxmox node TLS certificate ───────────────────
+        # ── 6. Migrate /etc/pve/nodes/<old> → /etc/pve/nodes/<new> ──────
-        # pvecm updatecerts -f is the canonical command for both standalone
+        # Proxmox stores VM and CT configs under /etc/pve/nodes/<nodename>/.
-        # and clustered nodes (PVE 6+).  Fall back to restarting pveproxy,
+        # This rename MUST happen before the reboot while pve-cluster is
-        # which regenerates the certificate automatically when it detects a
+        # running and pmxcfs is mounted — pmxcfs supports the rename live.
-        # hostname change.
+        # Without this step the node boots under the new hostname, finds an
+        # empty /etc/pve/nodes/<new>/ and all VMs appear missing.
+        if old_short and old_short != short_hostname:
+            pve_old = f"/etc/pve/nodes/{old_short}"
+            pve_new = f"/etc/pve/nodes/{short_hostname}"
+            migrate_out = self._exec_ssh_command(
+                f"if [ -d '{pve_old}' ] && [ ! -e '{pve_new}' ]; then"
+                f"  mv '{pve_old}' '{pve_new}'"
+                f"  && echo 'migrated {pve_old} -> {pve_new}';"
+                f"elif [ -d '{pve_new}' ]; then"
+                f"  echo 'target already exists, skipping migration';"
+                f"else"
+                f"  echo 'source {pve_old} not found, skipping migration';"
+                f"fi"
+            )
+            logger.info("Proxmox node dir migration: %s", migrate_out)
+
+        # ── 7. Regenerate Proxmox node TLS certificate ───────────────────
+        # Use pvenode cert create --overwrite rather than pvecm updatecerts -f.
+        # pvecm updatecerts -f restarts pve-cluster which briefly unmounts the
+        # cluster filesystem (/etc/pve) and can crash running VMs.
+        # pvenode cert create --overwrite only touches the node's own cert and
+        # restarts pveproxy (safe while VMs are running).
         cert_out = self._exec_ssh_command(
-            "pvecm updatecerts -f 2>&1"
+            "pvenode cert create --overwrite 1 2>&1"
-            " || pvenode cert create --overwrite 1 2>&1"
             " || { systemctl restart pveproxy 2>&1; echo 'restarted pveproxy'; }"
             " || true"
         )