agent v0.51.0: local vzdump retention default (--prune-backups keep-last=3)

The preventive counterpart to host_disk + storage_fill detectors: the periodic local
whole-guest vzdump now prunes its own old archives (keep-last=3, clamped >=1) so a box
can't refill its own root via its own backups. Local target only — PBS never pruned
(resolved via ListStorage; fail-safe skip on unknown). Seeded in host-install.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

CHANGELOG.md

@@ -1,3 +1,28 @@
+## v0.51.0 — local vzdump retention default (`--prune-backups keep-last=3`) (2026-06-30)
+
+The PREVENTIVE counterpart to the hub's host_disk + storage_fill detectors: the agent's periodic local
+whole-guest vzdump now prunes its own old archives, so a box can't refill its own root via its own backups
+(the felhom-pve incident's root cause — that vzdump carried no retention, ~18 dumps piled under
+`/var/lib/vz/dump`).
+
+- **`internal/proxmox/mutate.go`:** `VzdumpOptions.PruneBackups` → passed as PVE's `--prune-backups` on
+  the vzdump POST (vmid+storage scoped, so PVE prunes only THIS guest's archives on THIS storage).
+- **`internal/backup/runner.go`:** `NewBackupRunner` gains a `retention` arg; the backup applies it via
+  `localPruneSpec` ONLY when the target is a **non-PBS** storage (resolved via `ListStorage`) — PBS offsite
+  retention is a separate lifecycle and is never pruned by the per-run flag. **Fail-safe:** if the target
+  type can't be confirmed (lookup error / not found) the run SKIPS pruning rather than risk pruning PBS
+  (the detectors remain the safety net). Only the periodic local-API runner sets retention; the
+  restore-test / selftest runners pass "".
+- **`internal/config/config.go`:** `backup.local_backup_retention` (keep-last N) with `KeepLast()` clamped
+  to **≥1** (0/unset/negative → default 3) — a mis-config can NEVER prune the just-made backup —
+  + `PruneBackupsSpec()` → `keep-last=N`. Wired into the local-API backup runner (`main.go`).
+- **Seeding:** `felhom.eu scripts/felhom-host-install.sh` seeds `local_backup_retention: 3` in the agent
+  config; the code default also protects any box where it is unset (KeepLast → 3) from day 0.
+- F2-b stale-vzdump-lock recovery untouched.
+- Tests: the local vzdump carries `--prune-backups keep-last=3` (+ companion: no-retention runner emits no
+  prune); **PBS is never pruned** (+ companion: same retention on a local target IS applied);
+  fail-safe-on-unknown-target; the **keep-last≥1 clamp** companion. `go build/vet/test ./...` green.
+
 ## v0.50.0 — NAS network storage Part A1: NFS/SMB automount foundation (2026-06-30)
 
 Agent foundation of the validated `SPIKE-nas-storage-2026-06-29.md` (verdict READY): a customer NAS can