v0.23.0: device-ROLE classification + tiered storage-wipe gate (user-data customer-confirmable; system/backup operator-only)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/classify.go

@@ -49,6 +49,23 @@ const (
 	Benign Disposition = "benign"
 	// Destructive — an operator signature bound to the action is REQUIRED.
 	Destructive Disposition = "destructive"
+	// CustomerConfirmable — a USER-DATA storage wipe: authorized by the customer's informed-
+	// confirmation bound to the device's durable id, NOT an operator signature. This tier is
+	// reachable ONLY for ClassStorageWipe on an agent-classified user-data device (see
+	// Gate.AuthorizeStorageWipe). A user-data drive is already within the in-guest controller's
+	// blast radius (it bind-mounts /mnt), so customer-confirmation adds no new reach — the data was
+	// already destroyable. Every OTHER destructive class keeps the operator signature.
+	CustomerConfirmable Disposition = "customer_confirmable"
+)
+
+// Storage ROLE values — the protection tier the AGENT assigns a device by its own inspection
+// (mirrors storage.DeviceRole). Kept as plain strings here to avoid a storage→reconcile import edge:
+// the localapi adapter passes the agent's classification through verbatim. The gate NEVER derives the
+// role from a caller's claim — it only consumes the agent's verdict.
+const (
+	StorageRoleSystem   = "system"
+	StorageRoleBackup   = "backup"
+	StorageRoleUserData = "user-data"
 )
 
 // Provenance is AGENT-INTERNAL evidence that an otherwise-destructive action is