plan: full migrate-to-Hetzner (provision → cut over loops → stop old b1 VM); server type cpx31→cpx32

- plan-cc-ci-hetzner-migration.md: 3-phase plan — (1) provision the Hetzner cpx32 cc-ci fully + green
  !testme readiness gate, (2) repoint the loops + dashboard + *.ci at it (one ssh-config + DNS change),
  (3) stop the b1 cc-nix-test (cold standby). Parallel bring-up, reversible cutover, b1 freed.
- plan-cc-ci-hetzner-terraform.md: cpx31 is retired → default to cpx32 (current dedicated-vCPU 8GB).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cc-ci-plan/plan-cc-ci-hetzner-terraform.md

@@ -47,9 +47,11 @@ terraform/
 - **Provider:** `hetznercloud/hcloud` (pinned in `versions.tf`). The token comes from
   **`HCLOUD_TOKEN`** (env, read by the provider) or `TF_VAR_hcloud_token` — it's in `.testenv`; do
   NOT hardcode/commit it.
-- **Server:** `hcloud_server` — type **`cx32`** (Intel **shared vCPU**, **4 vCPU / 8 GB**) — must be
-  **x86** (the flake is `x86_64-linux`; do **NOT** use the `cax*` ARM types). `cpx31` (AMD, 4 vCPU /
-  8 GB) is an acceptable alt. `image = "ubuntu-24.04"` (nixos-infect-supported base), a `location`
+- **Server:** `hcloud_server` — type **`cpx32`** (AMD **dedicated vCPU**, **8 GB RAM**, NVMe SSD) —
+  **DEFAULT** (operator 2026-05-31: `cpx31` is **retired**; `cpx32` is the current dedicated-vCPU 8 GB
+  type). Dedicated vCPU avoids noisy-neighbor variance for bursty CI. Must be **x86** (the flake is
+  `x86_64-linux`; do **NOT** use the `cax*` ARM types). `cx32` (Intel shared vCPU, 8 GB) is a cheaper
+  alt. Confirm exact specs from the hcloud API at apply time. `image = "ubuntu-24.04"` (nixos-infect-supported base), a `location`
   (e.g. `nbg1`/`fsn1`/`hel1` EU or `ash`/`hil` US — pick one, make it a var), `ssh_keys=[hcloud_ssh_key.id]`,
   `user_data=file("user-data.sh")`, `public_net { ipv4_enabled = true }`, a stable name + label.
 - Keep the token + TS key **sensitive**; `terraform.tfstate` **gitignored** (can hold secrets) — mirrors