Three fixes, no new command and no change to any piped output.

Fixed

• The kubeone driver gives the Hetzner cloud-controller-manager the private network id whenever the cluster has one. Before, the id travelled only with Robot credentials, so a cloud-only cluster with a private network rendered a CCM that refused every node's private --node-ip and lo provision waited in "nodes to initialize by CCM" until it timed out. Clusters with bare-metal workers never saw it.
• The provider bridge hands the bash tree the project's kustomize plugin home (KUSTOMIZE_PLUGIN_HOME), as the binary sets it for its own kustomize children. On a clean shell, lo provision with the kubeone driver failed in the driver's render with "unable to find plugin root".
• The tempo addon runs without a Go ballast and with GOMEMLIMIT under a 1.5 GiB limit. The chart's default ballast equalled the old 1 GiB limit, so the process was killed at every block replay.

Notes

lo provision on real infrastructure asks for --force when no terminal is attached; a script that drives it passes the flag.