Add Flatcar VM for cisa-kev-rss on goose (#4)

Provision a dedicated Flatcar host that runs the CISA KEV RSS container
from GHCR, with a dozzle agent and hub remote entry like the other VMs.

Co-authored-by: Cursor Agent <[email protected]>

terraform.tfvars

@@ -251,6 +251,19 @@ nodes = {
         qemu_guest_agent = false
         butane_file      = "butane/monitor.yaml"
       }
+      # CISA Known Exploited Vulnerabilities catalog as an RSS feed.
+      # Stateless container; feed at :3000/rss.
+      "cisa-kev-rss" = {
+        hostname         = "cisa-kev-rss"
+        vmid             = 214
+        ip               = "192.168.7.64"
+        vlan             = 7
+        memory           = 1024
+        cores            = 1
+        disk_size        = 16
+        qemu_guest_agent = false
+        butane_file      = "butane/cisa_kev_rss.yaml"
+      }
     }
     machines = {
       "grist" = {