fix(BRE2-662): Ensure ufw is installed during nebius cloudinit (#88)

* fix(BRE2-662): Ensure ufw is installed during nebius cloudinit

* wait for cloud-init

Author: drewmalin

v1/image.go

@@ -40,6 +40,9 @@ func ValidateInstanceImage(ctx context.Context, instance Instance, privateKey st
 		}
 	}()
 
+	// If cloud-init is present, wait until it has finished (e.g. UFW/runcmd done).
+	_, _, _ = sshClient.RunCommand(ctx, "cloud-init status --wait 2>/dev/null || true")
+
 	arch, err := validateArchitecture(ctx, sshClient)
 	if err != nil {
 		return err

v1/providers/nebius/instance.go

@@ -1748,7 +1748,10 @@ func (c *NebiusClient) cleanupOrphanedBootDisks(ctx context.Context, testID stri
 // This is inspired by Shadeform's LaunchConfiguration approach but uses cloud-init instead of base64 scripts
 func generateCloudInitUserData(publicKey string, firewallRules v1.FirewallRules) string {
 	// Start with cloud-init header
-	script := "#cloud-config\n"
+	script := `#cloud-config
+packages:
+  - ufw
+`
 
 	// Add SSH key configuration if provided
 	if publicKey != "" {