GL-5: explicit rootfs override for DR restore (live-discovered PVE constraint)

The live validation hit PVE's all-or-nothing restore rule: mpN params
without an explicit rootfs -> HTTP 500 "mount points configured, but
'rootfs' not set" (the same constraint restoretest.go:211 documents for the
live-config path; the spike never ran an override restore). The lost guest
has no live config, so the rootfs SIZE now comes from the archive's own
embedded config via NEW Client.ExtractArchiveConfig (GET vzdump/
extractconfig - verified live: answers 200 under the scoped agent token;
PBS keys stay server-side, the spike's candidate-1 rejection holds; used
for the SIZE ONLY - the bind layout stays the platform constants).
Unparseable/unreadable archive config -> clean refusal before any restore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/reconcile/state.go

@@ -172,6 +172,10 @@ type GuestAPI interface {
 	ResizeLXC(ctx context.Context, vmid int, disk, size string) (string, error)
 	// RestoreLXC restores an archive into a (fresh) vmid — the create path (slice 6). Async → UPID.
 	RestoreLXC(ctx context.Context, opts proxmox.RestoreLXCOptions) (string, error)
+	// ExtractArchiveConfig reads the guest config embedded in a backup archive (raw pct-conf text).
+	// The DR bring-up sizes its explicit rootfs override from it (GL-5) — PVE refuses a restore
+	// carrying mpN params without an explicit rootfs, and the lost guest has no live config.
+	ExtractArchiveConfig(ctx context.Context, volume string) (string, error)
 	// PoolAddVMID re-asserts pool membership after a restore-over-existing (campaign-2 R2). Sync (no
 	// UPID); idempotent. Membership is what lets the pool-scoped token reach the guest next time.
 	PoolAddVMID(ctx context.Context, pool string, vmid int) error