fix(engine): tighten isEffectivelyEmptyYAML for indented separators

Previously the function ran bytes.TrimSpace on each line before
comparing against "---"/"...", which means an indented "  ---"
(a YAML scalar inside a parent mapping, not a document separator)
would be treated as a separator and hide a real overlay. Compare
against the line minus only trailing whitespace instead — separators
must be at column 0 per the YAML spec.

Comments and blank lines still use the fully trimmed form: a
comment can be indented, an empty line is empty regardless of where
in the file it appears.

Add a regression case to TestNodeFileHasOverlay covering the
indented-separator edge.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/engine/engine.go

@@ -261,6 +261,11 @@ func NodeFileHasOverlay(patchFile string) (bool, error) {
 // YAML comments, document separators, and whitespace. Used by
 // MergeFileAsPatch to detect modeline-only node files that the Talos
 // config-patcher misclassifies as empty JSON6902 patches.
+//
+// Document separators must appear at column 0 per the YAML spec; an
+// indented "  ---" is a scalar inside a parent mapping, not a
+// separator, so the comparison is against the line minus only trailing
+// whitespace rather than against the fully trimmed form.
 func isEffectivelyEmptyYAML(data []byte) bool {
 	for _, line := range bytes.Split(data, []byte("\n")) {
 		trimmed := bytes.TrimSpace(line)
@@ -270,7 +275,8 @@ func isEffectivelyEmptyYAML(data []byte) bool {
 		if trimmed[0] == '#' {
 			continue
 		}
-		if string(trimmed) == "---" || string(trimmed) == "..." {
+		untrailed := string(bytes.TrimRight(line, " \t\r"))
+		if untrailed == "---" || untrailed == "..." {
 			continue
 		}
 		return false

pkg/engine/render_test.go

@@ -1204,6 +1204,16 @@ machine:
 `,
 			want: true,
 		},
+		{
+			// A "---" with leading whitespace is not a YAML document
+			// separator (separators must be at column 0); it's a
+			// scalar inside a parent mapping. Treating it as a
+			// separator would misclassify a real overlay as empty
+			// and let the multi-node guard be bypassed.
+			name:    "indented separator counts as overlay",
+			content: "# talm: nodes=[\"a\",\"b\"]\nmachine:\n  ---\n",
+			want:    true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {