feat: add T3 Code LXC template

[lukdz]

✍️ Description

Adds a T3 Code LXC template for ProxmoxVED. T3 Code is installed bare-metal with Node.js 24 and runs as a dedicated non-root t3 user under a systemd user service.

The implementation follows the ProxmoxVED script conventions:

• Uses setup_nodejs, ensure_dependencies, install_packages_with_retry, setup_deb822_repo, and the GitLab release helper.
• Stores T3 Code runtime and userdata in /opt/t3-code_data, outside the application home.
• Migrates legacy /home/t3/.t3 data on update and rejects ambiguous dual-directory state.
• Restores provider, version-control, and source-control selection menus in Advanced mode through the generic hook from the related core PR: feat: add advanced settings application hook core#8
• Preserves exported var_* values for unattended installs and app-default configuration.
• Generates one-hour pairing URLs.
• Supports optional Codex, Claude, Grok, OpenCode, GitHub CLI, GitLab CLI, and Azure CLI installation. Authentication remains manual.
• Does not use Docker, apt-get, git pull, custom release download logic, remote shell installers, or custom credential files.
• Cursor is documented but not installed automatically because its upstream installer is a remote shell script and cannot be used under the project rules.

The Advanced selection menus are implemented through advanced_settings_app_configure and advanced_settings_app_summary; no core function is replaced or parsed. Supplied var_* values remain available for non-interactive installs, while Advanced mode displays the current selections and allows changing them.

AI assistance disclosure: refactored and reviewed with OpenCode, model gpt-5.6-luna, reasoning level high, using AGENTS.md and .github/agents/pve-script-creator.agent.md.

🔗 Related PR / Issue

Link: community-scripts/core#8

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Static validation passed; installation and Grok provider authentication were tested in an LXC.
• No breaking changes – Existing functionality remains intact.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🏗️ arm64 Support (X in brackets)

• arm64 supported - Tested and supported on arm64.
• arm64 not tested - Assumed to work on arm64, but testing has not been done.
• arm64 not supported - Confirmed upstream dependencies or binaries do not support arm64.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

🔍 Code & Security Review (X in brackets)

• Follows CODE-AUDIT.md & CONTRIBUTING.md guidelines
• Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
• No hardcoded credentials
• No Docker / Docker Compose – The application is installed bare-metal; Docker is not used.
• No git pull – Updates use supported release/update mechanisms instead of git pull.

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

---

📋 Additional Information (optional)

Validation completed:

• bash -n passed for all 277 repository shell scripts.
• jq empty passed for all 103 JSON metadata files.
• Prohibited-pattern checks passed for the T3 files.
• T3 Code installation and Grok provider authentication were tested in an LXC before this refactor.
• The core hook branch passes engine syntax, prefetch, API, and whitespace checks.
• Test both branches together before the core hook merges:

export COMMUNITY_SCRIPTS_URL="https://raw.githubusercontent.com/lukdz/ProxmoxVED/feat/t3-code"
export COMMUNITY_SCRIPTS_CORE_URL="https://raw.githubusercontent.com/lukdz/core/feat/advanced-settings-hook"
bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/t3-code.sh")"

---

📦 Application Requirements (for new scripts)

⚠️ Do not remove this section.
It is used by automated PR validation checks.
If this PR is not a new script submission, leave the checkboxes unchecked.

Required for 🆕 New script submissions.
Pull requests that do not meet these requirements may be closed without review.

• The application is at least 6 months old
• The application is actively maintained
• The application has 600+ GitHub stars
• Official release tarballs are published
• I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

🌐 Source

• Website: https://t3.codes/
• Repository: https://github.com/pingdotgg/t3code
• Installation documentation: https://github.com/pingdotgg/t3code/blob/main/docs/user/install.md

[github-actions]

Try this script

COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/lukdz/ProxmoxVED/feat/t3-code \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/lukdz/ProxmoxVED/feat/t3-code/ct/t3-code.sh)"

COMMUNITY_SCRIPTS_URL is not optional. Fetching the ct/ script from a branch
does not tell the engine where that branch is — with bash -c "$(curl …)" there
is no file on disk for the scripts root to be derived from, so it would fall back
to upstream main and look for the install script there.

Against a core branch as well

Add COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/OWNER/core/BRANCH
to test an engine change at the same time. The two resolve independently.

Useful flags while testing

dev_mode=net logs every fetch with status and duration, so you can confirm the
branch is really being used. dev_mode=keep stops a failed build from deleting
the container along with the evidence.

[lukdz]

Dear maintainers please check my PR, I hope I have solved all issues reported by bot.

BTW. Please consider updating bot to "update" msg, instead of creating new ones (at least when bot msg is the last one). Maybe I should create an issue for it? I may be interested in contributing to it, if you consider this to be a good idea.

[MickLesk]

Refactor your whole code based on the AGENTS.md or the script creator, you pr is far far away from our conventions https://github.com/community-scripts/ProxmoxVED/blob/main/.github/agents/pve-script-creator.agent.md

[asylumexp]

these scripts are absolutely massive. this can be shortened down massively by not trying to cover every single case that could possibly happen. you need to go back and redo this script.

[asylumexp]

unless required get rid of the t3 user, the whiptail prompts. you shouldn't need to grep for a string in a just created container, etc.

[lukdz]

Refactor your whole code based on the AGENTS.md or the script creator, you pr is far far away from our conventions https://github.com/community-scripts/ProxmoxVED/blob/main/.github/agents/pve-script-creator.agent.md

I stared my work in ProxmoxVE which lacks those files.

these scripts are absolutely massive. this can be shortened down massively by not trying to cover every single case that could possibly happen. you need to go back and redo this script.

A bunch of code was needed to install glab, Azure CLI + DevOps ext, but since they are not most popular I'll drop them.

unless required get rid of the t3 user, the whiptail prompts. you shouldn't need to grep for a string in a just created container, etc.

Using root is a bit less secure but making installing packages using AI agent easy and primary protection of proxmox host is LXC.

Thanks for suggestion. I applied them on new branch/PR