agent v0.33.0: C1 net — pre-start self-heal hook + decommission mp-delete

Pre-start PVE hookscript (internal/guesthook) creates host-root placeholders for
absent bind-mount sources so the guest always boots (fail-closed); decommission
now pct set --delete's the dead mp (GuestBinder.DetachBind) so a missing source
can't brick the next reboot (B3 C1 bug). Non-hollow tests + companions. Installed
+ registered per-guest by the provision back-half. Transitional ahead of the
intermediary-mount re-architecture which makes C1 structural.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/provision/backhalf.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"strconv"
 
+	"gitea.dooplex.hu/admin/felhom-agent/internal/guesthook"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
 )
 
@@ -145,6 +146,15 @@ func (b *BackHalf) Provision(ctx context.Context, in Input) (Result, error) {
 		return Result{}, fmt.Errorf("provision: attach config mount: %w", err)
 	}
 
+	// 6. Install + register the pre-start self-heal hook (C1 net): if a data drive is absent at a future
+	//    boot, the hook creates a placeholder for its missing bind source so the guest still starts.
+	//    Best-effort + non-fatal — it's defense-in-depth; a provision must not fail over the hook.
+	if err := guesthook.InstallSnippet(ctx, b.runner); err != nil {
+		b.logger.Warn("provision: pre-start hook snippet install failed (non-fatal)", "vmid", in.VMID, "err", err)
+	} else if err := guesthook.Register(ctx, b.runner, in.VMID); err != nil {
+		b.logger.Warn("provision: pre-start hook registration failed (non-fatal)", "vmid", in.VMID, "err", err)
+	}
+
 	b.logger.Info("provision: back-half complete",
 		"vmid", in.VMID, "mount", mountKey, "guest_path", guestPath, "endpoint", in.Endpoint)
 	// tok intentionally goes out of scope here — never logged, never returned.