workspace/hetzner: delete server on post-Create error; set vmID immediately (audit #8)

[dennisonbertram]

Intent

Stop orphaning billable Hetzner cloud VMs on any post-Server.Create error or cancellation by deleting the server before returning the error and setting vmID immediately.

Plan reference

• Plan: docs/plans/2026-06-24-harness-reliability-plan.md — slice T09
• Umbrella epic: epic: harnessd long-session reliability hardening (15 TDD slices, audit 2026-06-24) #644
• Audit finding: Workspace abstraction: transparent local/remote file and tool execution #8

Source finding

Cloud VM is orphaned on any post-Create error or cancellation (internal/workspace/hetzner.go:64-103, vm.go:35-47). After Server.Create succeeds, a polling failure returns without setting w.vmID, so VMWorkspace.Destroy is a no-op and the billable server lingers forever.

Scope

• Allowed files (test): internal/workspace/hetzner_test.go (extend), vm_test.go (extend)
• Allowed files (impl): internal/workspace/hetzner.go, internal/workspace/vm.go
• Dependencies: none
• Complexity: low — Risk: low

Acceptance criteria

Use slice T09 in the plan as detailed acceptance criteria. Summary:

• Failing test written first, compiles and fails on main.
• With a fake Hetzner client whose GetByID always errors after Server.Create returned a server, HetznerProvider.Create returns an error AND the fake records a Server.Delete(server.ID) call. Today the server lingers.
• Impl: in HetznerProvider.Create, after Server.Create succeeds, defer-on-error a best-effort p.client.Server.Delete(forceCtx, server). In VMWorkspace.Provision, set w.vmID = server.ID immediately after Create succeeds so a caller-initiated Destroy can clean up.
• go test ./internal/workspace/... -race green; ./scripts/test-regression.sh green.

Guardrails

• Strict TDD; failing regression test must compile and fail on main first.
• Worktree flow; own branch, merge via verify-and-merge.sh.
• Update .context/harness-reliability/tracker.md on pick-up and merge.
• Deterministic tests only — fake Hetzner client; no real cloud calls.
• Append engineering-log entry on merge.