Require confirmation for direct nuke

jeannie

@@ -4083,7 +4083,7 @@ rebuild_cluster() {
     jeannie_step_plan 10
 
     run_step "Preflight" homelab_preflight
-    run_step "Nuke existing cluster state" nuke
+    run_step "Nuke existing cluster state" nuke_for_rebuild
     run_step "Pimox provisioning and workers" run_pimox_pipeline
     run_step "OpenWrt VM" run_openwrt_pipeline
     run_step "Worker var file" ensure_cluster_worker_var_file
@@ -4097,6 +4097,10 @@ rebuild_cluster() {
     echo "Log: ${JEANNIE_LOG_FILE}"
 }
 
+nuke_for_rebuild() {
+    LAB_NUKE_SKIP_CONFIRM=true nuke
+}
+
 cluster_worker_targets() {
     local worker_ssh_targets="${WORKER_SSH_TARGETS-}"
     local var_file="${REPO_ROOT}/.lab/cluster-workers.auto.tfvars.json"
@@ -4971,6 +4975,14 @@ nuke() {
 
     require_debian_server "nuke"
 
+    if ! truthy "${LAB_NUKE_SKIP_CONFIRM:-false}" && [[ "${LAB_CONFIRM_NUKE:-}" != "homelab" ]]; then
+        cat >&2 <<'EOF'
+nuke destroys Kubernetes state and Pimox worker VMs.
+Rerun with LAB_CONFIRM_NUKE=homelab when that destructive action is intended.
+EOF
+        exit 1
+    fi
+
     echo "Brutally nuking the homelab infrastructure..."
     cluster_worker_targets