Add resolve_os_version() and refactor template handling

- Add `resolve_os_version()` to validate `var_version` against the host's pveam catalog before the settings summary, picking the nearest available version with interactive or unattended fallback
- Extract `_list_os_versions()` and `_list_templates()` helpers to reduce duplication
- Remove the inline version-picker dialogs from `create_lxc_container()`; version mismatches are now handled upfront
- Change default Debian version from 12 to 13
- Fix implicit cancel on invalid/empty input in the LXC stack upgrade menu (return 2 instead of 4)
- Fix cancel option handling: only explicit option 3/4 cancels, unknown input is treated as ignore
- Honour return code 4 (cancel) from `offer_lxc_stack_upgrade_and_maybe_retry`
- Redirect error_handler log dump to stderr to prevent data corruption when the trap fires inside command substitutions

misc/error_handler.func

@@ -376,10 +376,12 @@ error_handler() {
     active_log="$BUILD_LOG"
   fi
 
+  # stderr, not stdout: the trap can fire inside a $(...) or < <(...) capture,
+  # and a caller reading that stream must never ingest this dump as data.
   if [[ -n "$active_log" && -s "$active_log" ]]; then
-    echo -e "\n${TAB}--- Last 20 lines of log ---"
-    tail -n 20 "$active_log"
-    echo -e "${TAB}-----------------------------------\n"
+    echo -e "\n${TAB}--- Last 20 lines of log ---" >&2
+    tail -n 20 "$active_log" >&2
+    echo -e "${TAB}-----------------------------------\n" >&2
   fi
 
   # ── Node.js heap OOM detection with actionable guidance ──