controllerswap: F1 verify hardening — reject crash-looping no-healthcheck image v0.47.0

controllerHealthy reads RestartCount (running&&rc>0 -> not ok) + signals needsDwell for no-healthcheck;
verify requires verifyDwell(=3) consecutive ok polls for a no-healthcheck image (real healthcheck
trusted immediately). Closes the F1 hole (alpine crash-loop passed the point-in-time check). Red-proof
+ dwell + real-image tests. No sudoers/orchestration change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/localapi/server.go

@@ -207,24 +207,24 @@ func NewServer(o Options) (*Server, error) {
 		cadence = defaultBackupCadence
 	}
 	s := &Server{
-		addr:        o.ListenAddr,
-		cert:        o.Cert,
-		guests:      o.Guests,
-		backups:     o.Backups,
-		store:       o.Store,
-		storage:     o.Storage,
-		tokens:      o.Tokens,
-		cadence:     cadence,
-		logger:      o.Logger,
-		now:         func() time.Time { return time.Now().UTC() },
-		disks:       o.Disks,
-		diskGate:    o.DiskGate,
-		guestList:   o.Guests2,
-		guestAttach: o.GuestAttach,
-		intent:      o.Intent,
-		guestBinds:  o.GuestBinds,
-		formatJobs:  o.FormatJobs,
-		host:        o.HostReader,
+		addr:         o.ListenAddr,
+		cert:         o.Cert,
+		guests:       o.Guests,
+		backups:      o.Backups,
+		store:        o.Store,
+		storage:      o.Storage,
+		tokens:       o.Tokens,
+		cadence:      cadence,
+		logger:       o.Logger,
+		now:          func() time.Time { return time.Now().UTC() },
+		disks:        o.Disks,
+		diskGate:     o.DiskGate,
+		guestList:    o.Guests2,
+		guestAttach:  o.GuestAttach,
+		intent:       o.Intent,
+		guestBinds:   o.GuestBinds,
+		formatJobs:   o.FormatJobs,
+		host:         o.HostReader,
 		hostMetrics:  o.HostMetrics,
 		hostID:       o.HostID,
 		jobs:         map[int]*backupJob{},