Two fixes, no new command and no change to the piped output of the parity cases.

Fixed

• A lo provision that meets a Hetzner capacity refusal stops with Hetzner's own reason. The Hetzner provider dropped the exit status of hcloud <resource> create, so a placement refusal (error during placement (resource_unavailable)) printed one line and the run walked on into the KubeOne inventory, which then reported zero control-plane hosts and hinted at name drift. hetzner::create now stops on a non-zero create and names the resource, points at hcloud's message above it, and says what to do: choose another server type or location, or retry later. A re-run keeps what exists and creates the rest (#232).

• A cluster claimed after lo provision and before the agent deploys no longer goes silent. The announce (lo kubehz register, and the lo provision pre-announce) now stores the platform's one-time bind secret at clusters/<domain>/.kubehz-bind (mode 0600). lo kubehz deploy stages it into the cluster as the Secret kubehz-agent-bind (read from the file, never a command line), and the heartbeat agent presents it when it registers. The platform then ADOPTS the announced row wherever it sits by then, still pending or already claimed, instead of minting a second row whose beats strand where nobody can see them. So a cluster you claim in the dashboard before the agent deploys still shows its own heartbeats (#233). Both implementations carry the change.

Changed

• The one-time bind secret is a credential. lo init now ignores **/clusters/*/.kubehz-bind, and the kubehz guide documents the claim-before-deploy flow and how to keep the file out of version control.

Upgrade

Nothing to do. The bind secret is optional on both sides: an older platform returns none, so the CLI writes nothing and the agent registers as before; a cluster with no bind secret in play deploys unchanged.