Enhance encryption key management and update installation documentation

[egasa21]

This pull request introduces robust handling for the TALOS_ENCRYPTION_KEY, ensuring that Talos never silently regenerates the encryption key for existing installations—a critical change for the security and recoverability of encrypted service credentials. Now, Talos will only auto-generate the encryption key on first install, and will fail fast if the key is missing on an existing install, preventing accidental data loss. The installer and documentation have been updated to support explicit key regeneration, with clear user warnings and recovery instructions.

Encryption key handling and startup logic:

• Talos now only auto-generates TALOS_ENCRYPTION_KEY on first install. On existing installs, startup fails if the key is missing, instead of generating a new one that would break access to encrypted credentials (cmd/talos/main.go, [1] [2] [3] [4].
• Added tests to verify correct encryption key initialization and failure modes (cmd/talos/main_test.go, cmd/talos/main_test.goR52-R117).

Installer improvements:

• Added --regenerate-encryption-key flag to install.sh, allowing explicit, user-confirmed key rotation with clear warnings about destructive effects on existing encrypted credentials (scripts/install.sh, [1] [2] [3] [4] [5].

Documentation and user guidance:

• Updated documentation and help output to clarify encryption key lifecycle, backup importance, and explicit regeneration procedures. Added sections and warnings about key handling, loss, and regeneration in all relevant docs (README.md, [1] [2] [3]; docs/features/managed-services.md, [4]; docs/guide/backup.md, [5]; docs/guide/configuration.md, [6] [7]; docs/guide/installation.md, [8]; docs/guide/upgrading.md, [9] [10] [11].

These changes make encryption key handling explicit, safe, and user-driven, preventing accidental data loss and improving upgrade reliability.…existing installs