fixup! mkcloud: use cache=unsafe for VMs