v0.41.0: provision back-half sets onboot:1 so customer guests auto-start after host reboot (F3)

The golden bakes --onboot 0 (template safety) and the back-half never overrode it, so every
provisioned customer guest was onboot:0 -> after a host reboot/power-cut the customer's whole
home-server stayed stopped until a manual pct start. Add a fatal 'pct set <vmid> -onboot 1' step
to BackHalf.Provision (right after the config-mount attach), mirroring the existing pct set ops.
No startup/boot-order: the v0.75 mountpoint-gate covers the drive-bind race at boot.

Golden build-golden.sh unchanged (templates must not auto-start). Unit-tested
(TestProvision_SetsOnbootOne + red-proof). RUNBOOK note added.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FpBYrZCt9sFDqLgbG5GRGD

internal/provision/backhalf.go

@@ -153,6 +153,16 @@ func (b *BackHalf) Provision(ctx context.Context, in Input) (Result, error) {
 		return Result{}, fmt.Errorf("provision: attach config mount: %w", err)
 	}
 
+	// 5b. Ensure the customer guest auto-starts after a host reboot / power-cut (F3). The golden bakes
+	//     onboot:0 (template safety — the build guest must not auto-start); the provisioned customer
+	//     guest must come back on its own. No startup order/delay: the v0.75 mountpoint-gate covers the
+	//     drive-bind race at boot, so the controller won't write app data onto the rootfs while the agent
+	//     re-binds drives. Fatal like the config-mount attach above — a guest that won't auto-recover is
+	//     a provisioning defect, not a soft warning.
+	if err := b.run(ctx, "pct", "set", strconv.Itoa(in.VMID), "-onboot", "1"); err != nil {
+		return Result{}, fmt.Errorf("provision: set onboot: %w", err)
+	}
+
 	// 6. Install + register the pre-start self-heal hook (C1 net): if a data drive is absent at a future
 	//    boot, the hook creates a placeholder for its missing bind source so the guest still starts.
 	//    Best-effort + non-fatal — it's defense-in-depth; a provision must not fail over the hook.