slice 8A (agent half): local-API server + provisioning back-half (v0.10.0)

internal/localapi: per-guest local-API server (doc 03 §6) — 7 self-scoped
endpoints, hashed per-guest token store, persisted self-signed leaf with stable
SHA-256 pin, optional 6th daemon goroutine. internal/provision: back-half —
mint token, render bootstrap.json (no registry cred), write 0600, chown
100000:100000, attach pct-set bind mount (host-side, F3, no pct exec).
--selftest=provision. build-golden.sh bakes the controller image + bootstrap
unit. sudoers FELHOM_PROVISION; firewall narrowing artifact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

configs/agent.example.json

@@ -45,5 +45,12 @@
     "pbs_verify_cadence_seconds": 0,
     "pbs_secret_dir": "/etc/pve/priv/storage"
   },
+  "local_api": {
+    "enable": true,
+    "listen_addr": "192.168.0.162:8443",
+    "cert_file": "/var/lib/felhom-agent/local-api.crt",
+    "key_file": "/var/lib/felhom-agent/local-api.key",
+    "token_store": "/var/lib/felhom-agent/local-tokens.log"
+  },
   "log_level": "info"
 }