v0.5.0-rc1: slice 5 Phase A — storage observe/report + watchdog (read-only, live)

Fill the slice-3 storage_targets stub and add the fast-poll storage watchdog.
Read-only this phase; the host-root surface (mounts/SMART/grow/destructive gate)
is Phase B. Hub-owned desired manifest is slice 10, so reconcile against it is
built-but-unfed.

- internal/storage: StorageTarget wire contract, durable_id derivation per type,
  HostReader seam (procfs/sysfs, root-free), Observer (storage_targets from
  ListStorage/NodeStorage + host reads, lvmthin thin-pool fill), and the watchdog
  (third daemon goroutine; debounced out-of-band report on a known target's
  attach/disconnect transition).
- proxmox.Storage: additive parse-only config fields (durable_id sources).
- collector StorageObserver seam; Loop.SetTrigger out-of-band report; daemon runs
  the watchdog as a third goroutine; StorageConfig knobs.
- cross-repo golden kept byte-identical with felhom.eu/hub; bidirectional key-set test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/contract_test.go

@@ -24,7 +24,8 @@ func TestHostReport_ContractMatchesGolden(t *testing.T) {
 		t.Fatalf("golden is not valid JSON: %v", err)
 	}
 
-	// A constructed report mirroring the golden's populated shape (guests[0] has spec).
+	// A constructed report mirroring the golden's populated shape: guests[0] has spec,
+	// storage_targets[0] is an lvmthin (so its thin_pool + smart sub-objects are exercised).
 	report := &HostReport{
 		HostID: "demo-host-01", ReportedAt: "2026-06-08T12:00:00Z", AgentVersion: "0.3.1",
 		Host: HostMetrics{Node: "demo-felhom", LoadAvg: []string{"0.10"}},
@@ -32,9 +33,22 @@ func TestHostReport_ContractMatchesGolden(t *testing.T) {
 			{VMID: 100, Name: "a", Status: "running", ControllerVersion: "", Spec: &GuestSpec{Cores: 2}},
 			{VMID: 101, Name: "b", Status: "stopped", ControllerVersion: ""},
 		},
-		StorageTargets: []StorageTarget{}, Backups: []Backup{}, RestoreTests: []RestoreTest{},
+		StorageTargets: []StorageTarget{
+			{
+				Name: "local-lvm", Type: StorageTypeLVMThin, DurableID: "pve/data",
+				State: StorageStateAttached, Reachable: true, ClassHint: "fast",
+				ThinPool: &ThinPoolFill{DataUsedFraction: 0.42},
+				Smart:    SmartSummary{Health: SmartUnknown},
+			},
+			{
+				Name: "usb-backup", Type: StorageTypeUSB, DurableID: "uuid:x",
+				State: StorageStateAttached, Reachable: true,
+				Smart: SmartSummary{Health: SmartUnknown},
+			},
+		},
+		Backups: []Backup{}, RestoreTests: []RestoreTest{},
 		PBSSnapshots: []PBSSnapshot{}, AuditTail: []AuditEntry{},
-		Cloudflared: Cloudflared{Status: "active"},
+		Cloudflared:  Cloudflared{Status: "active"},
 	}
 	b, _ := json.Marshal(report)
 	var got map[string]any
@@ -44,6 +58,23 @@ func TestHostReport_ContractMatchesGolden(t *testing.T) {
 	assertSameKeys(t, "host", golden["host"], got["host"])
 	assertSameKeys(t, "guests[0]",
 		firstElem(golden["guests"]), firstElem(got["guests"]))
+
+	// storage_targets[0] is the slice-5 addition — assert its full key set and both
+	// sub-objects (smart always present; thin_pool present for the lvmthin element).
+	gst := firstElem(golden["storage_targets"])
+	sst := firstElem(got["storage_targets"])
+	assertSameKeys(t, "storage_targets[0]", gst, sst)
+	assertSameKeys(t, "storage_targets[0].smart", field(gst, "smart"), field(sst, "smart"))
+	assertSameKeys(t, "storage_targets[0].thin_pool", field(gst, "thin_pool"), field(sst, "thin_pool"))
+}
+
+// field extracts a nested object value from a decoded JSON map (nil if absent/not a map).
+func field(v any, key string) any {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return nil
+	}
+	return m[key]
 }
 
 func firstElem(v any) any {