terraform+nix: Hetzner orchestrator server (cpx11, nixos-infect, cc-ci-orchestrator-hetzner flake host)

Adds terraform/ to provision a Hetzner cpx11 (2 vCPU / 2 GB dedicated AMD / 40 GB NVMe)
for the loops runtime, and a flake + NixOS host config to converge it — replacing the slow
b1 Incus VM. Mirrors the cc-ci server terraform (same nixos-infect pin, same pattern).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

terraform/user-data.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Stage 1 — convert Debian 12 → NixOS via nixos-infect (pinned revision).
+#
+# nixos-infect generates /etc/nixos/{configuration.nix,hardware-configuration.nix,networking.nix}
+# with Hetzner-correct bootloader (GRUB) and networking, then reboots into NixOS.
+#
+# After the reboot SSH as root is available. Run Stage 2 per terraform/README.md.
+# Logs: /var/log/nixos-infect.log
+
+set -euo pipefail
+
+# Same pinned revision as the cc-ci server terraform (2026-03-22).
+INFECT_SHA="40f62a680bb0e8f2f607d79abfaaecd99d59401c"
+
+export NIX_CHANNEL="nixos-24.11"
+export PROVIDER="hetzner"
+export NIXOS_IMPORT=""
+
+curl -fsSL "https://raw.githubusercontent.com/elitak/nixos-infect/${INFECT_SHA}/nixos-infect" \
+  | bash -x 2>&1 | tee /var/log/nixos-infect.log