Full strict Trunk adoption (enable pedantic rules + clear per-repo backlog)

[cshuttle]

Initial Trunk rollout runs all linters enabled but pedantic style rules non-blocking (see the per-repo .trunk/ configs: yamllint/quoted-strings and markdownlint MD025/MD036/MD041 disabled; tflint terraform_unused_declarations suppressed inline with TODOs). High-value checks (tflint version constraints, checkov, shellcheck/actionlint errors, secrets) block.

Follow-on (this issue): turn the pragmatic config into full strict enforcement, repo by repo:

• Re-enable the disabled markdownlint structural rules and restructure the docs they flag.
• Re-enable yamllint/quoted-strings where it doesn't conflict.
• Resolve each terraform_unused_declarations TODO — wire up or delete the module vars (e.g. proxmox-talos-terraform proxmox-vm module: pve_nodes/subnet/gateway/dns_servers/cluster_name).
• Any checkov findings deferred during rollout.

Tracks the gap between "Trunk manages tools + high-value gating" (done) and "full strict style enforcement" (later).