docs(nodes): SEV-SNP CRN on Scaleway Elastic Metal

[odesenfans]

Adds `nodes/compute/advanced/confidential/scaleway-sev-snp`, an operator guide for running a confidential CRN on Scaleway Elastic Metal, covering what the generic Enable Confidential page does not:

• Server selection: 4th-gen EPYC, microcode floors per processor family (AMD-SB-3019), why `amd64-microcode` cannot fix an old BIOS.
• BIOS updates: customers cannot flash Elastic Metal; what to put in the Scaleway support ticket and what to expect after the intervention (SEV firmware bump breaking SNP init, microcode possibly unchanged).
• IPv6: the native /64 is egress-filtered per address; VM pool must be a flexible IPv6 /64, no vMAC needed.
• Full `supervisor.env` template for a mainnet confidential CRN, registration order, verification commands.
• Functional tests for both the SEV session flow and the SNP attested flow.
• SEV platform recovery (`SECURE_DATA_INVALID`) via `SEV_FACTORY_RESET`.

Also adds a sidebar entry under Advanced Features and a pointer from the Enable Confidential page.

Content validated on the reference node (Dell C6615 / EPYC 8024P, BIOS 1.12.2, microcode 0x0aa0021c, aleph-vm 2.0).

🤖 Generated with Claude Code

https://claude.ai/code/session_01LwF8MmMGqDPX9Y16VwPvUj

[github-actions]

Deployed on:

• https://bafybeicpjgiwe3nfpng7wtr3sdt6nko25sumewacwtejpzndb5s27nlrq4.ipfs.aleph.sh

Preview for this pull request, updated on every commit and removed once the PR is closed.

[foxpatch-aleph]

A well-researched, technically deep operator guide that fills a genuine gap for CRN operators on Scaleway. The content reflects real hands-on experience and covers edge cases (SEV platform recovery, BIOS update workflow, IPv6 egress filtering) that would be difficult to discover otherwise. The two substantive issues are the config value inconsistency (=true vs =1) and the missing ALEPH_VM_ENABLE_QEMU_SUPPORT in the 'complete configuration' template — both could cause setup failures if the existing index.md values are the correct ones. The ioctl number in the recovery script is also worth verifying against the kernel headers used, though the author states it was validated on hardware. Everything else is minor formatting or style.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 222): The existing Enable Confidential page (index.md:37) uses ALEPH_VM_ENABLE_CONFIDENTIAL_COMPUTING=1 (integer 1), while this template uses =true. If the env var parser only accepts 1/0, this could silently fail. Confirm which form the supervisor accepts and align both documents.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 214): The 'complete configuration' template omits ALEPH_VM_ENABLE_QEMU_SUPPORT=1, which the existing Enable Confidential page (index.md:36) lists as required. If it is still needed, the template is incomplete; if it has been deprecated in aleph-vm 2.0, a brief note would help readers who cross-reference both pages.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 321): The ioctl code 0xC0105300 decodes to _IOWR('S', 0, 16-byte struct), which matches SEV_ISSUE_CMD with a 16-byte argument, not the direct SEV_FACTORY_RESET ioctl (_IOW('S', 0, int) = 0x40045300). The prose says "Issuing the SEV_FACTORY_RESET ioctl directly" — consider clarifying that this issues SEV_ISSUE_CMD with a factory-reset sub-command, or if 0x40045300 was intended, verify the number.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 320): Opening /dev/sev with mode 'wb' is unusual for an ioctl. Since it is a character device, truncation will not occur, but 'r+b' would be more conventional and avoids surprising readers.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 184): The example IPv6 prefix 2001:bc8:702:32d::/64 appears to be a real Scaleway-assigned range. Using a documentation prefix from 2001:db8::/32 would avoid exposing a potentially real network range, though for a Scaleway-specific guide a realistic example is arguably helpful.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 127): This line is significantly longer than the surrounding text and runs the advisory name, CVE, BIOS version, and next sentence together. Consider breaking after 'BIOS 1.6.2.' for readability.

[foxpatch-aleph]

Well-researched, technically detailed operator guide for running SEV-SNP CRNs on Scaleway Elastic Metal. All internal links resolve correctly, anchors are properly defined, and the Python recovery snippet is a legitimate SEV_FACTORY_RESET procedure with correct struct packing. The sidebar entry and cross-reference from the Enable Confidential page are appropriately placed. Placeholder variables and the RFC 3849 documentation IPv6 prefix are used correctly. No correctness, security, or quality issues found.

docs/nodes/compute/advanced/confidential/scaleway-sev-snp.md (line 347): Minor consistency nit: the temp file is /tmp/x.cert here but /tmp/chain.cert on line 269. Consider using the same name in both examples for consistency, though this is non-blocking.