v0.40.0: third CT volume — SSD user-data (/mnt/sys_drive, mp1) baked + -sysdata-grow

Extends the OS/Docker-data split to a three-volume layout: rootfs + Docker-data
(mp0) + SSD user-data (mp1 @ /mnt/sys_drive, backup=1) = the controller's
system_data_path. Clears the controller's "not a separate drive" warning with
zero controller change (it already auto-discovers <sys_drive>/felhom-data and
warns via system.IsMountPoint; the mp reaches the container via the existing
-v /mnt:/mnt:rslave bind).

- build-golden.sh: --mp1 ...,mp=/mnt/sys_drive,backup=1 (env GOLDEN_SYSDATA_GB=8);
  findmnt /mnt/sys_drive separate-mount guard + vzdump aborts if mp0 OR mp1 excluded.
- bringup.go: DefaultSysDataMount=mp1; BringUpSpec.{SysDataGrowGB,SysDataMount};
  new "4c" online grow-only block mirroring the "4b" Docker-data grow.
- main.go: -sysdata-grow / -sysdata-mount flags wired into all three call sites.
- Tests: SysDataGrow (asserts ResizeLXC mp1 +42G) + SysDataGrowZeroNoResize.
- RUNBOOK extended to the three-volume layout (32 rootfs + 200 docker + 50 user-data).

Static CT volume, NOT an enrolled drive — never enrolls/ejects/decommissions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PsnU2ASocYrvzqE82YDYW

CHANGELOG.md

@@ -3,6 +3,37 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## v0.40.0 — third CT volume: SSD user-data (`/mnt/sys_drive`, mp1) baked + `-sysdata-grow` (2026-06-23)
+
+**The third golden volume.** Extends the OS/Docker-data split (v0.29.x) to a **three-volume layout**:
+rootfs + Docker-data (`mp0`) + **SSD user-data (`mp1` @ `/mnt/sys_drive`, `backup=1`)** — the
+controller's `system_data_path`. Until now `/mnt/sys_drive` was a plain directory on the 32 GB OS
+rootfs, so the controller correctly warned that SSD app data (`<sys_drive>/felhom-data`) lands on the
+OS drive. Baking it as its own thin volume clears that warning with **zero controller change** (the
+controller already auto-discovers `<sys_drive>/felhom-data` and warns via `system.IsMountPoint`); the
+`mp` under the guest's `/mnt` reaches the controller container through the existing
+`-v /mnt:/mnt:rslave` bind.
+
+- **`configs/build-golden.sh`** — `pct create` gains
+  `--mp1 ${ROOTFS_STORAGE}:${GOLDEN_SYSDATA_GB},mp=/mnt/sys_drive,backup=1` (new env
+  `GOLDEN_SYSDATA_GB=8`, near-empty; provision grows it). The resilience guards are mirrored for `mp1`:
+  a `findmnt /mnt/sys_drive` separate-mount assertion, and the vzdump-inclusion guard now aborts if
+  **either** `mp0` **or** `mp1` is EXCLUDED (the B3 trap — extra mountpoints default `backup=0`). The
+  golden does NOT pre-create `felhom-data`; the controller does once it's a real mountpoint.
+- **`internal/reconcile/bringup.go`** — `const DefaultSysDataMount = "mp1"`; `BringUpSpec` gains
+  `SysDataGrowGB int` + `SysDataMount string`; a new **"4c"** grow block (online, grow-only `ResizeLXC`,
+  its own task) mirrors the "4b" Docker-data grow. `0 = skip` (separateness comes from the golden, not
+  the grow — the warning clears regardless of size).
+- **`cmd/felhom-agent/main.go`** — `-sysdata-grow` / `-sysdata-mount` flags (mirror
+  `-datavol-grow`/`-datavol-mount`); `bringUpSizing` carries them into all three bring-up/provision call
+  sites; `--selftest=provision` help text updated.
+- **Static volume, NOT an enrolled drive.** `/mnt/sys_drive` is part of the baked golden layout; it
+  never enrolls/ejects/decommissions and is deliberately kept off the drive-intent machinery.
+  `freeMountSlot` auto-skips the baked `mp0`/`mp1` so enrolled drives never collide.
+- Tests: `TestRunBringUp_StorageSplit_SysDataGrow` (asserts `ResizeLXC(vmid,"mp1","+42G")`) +
+  `…_SysDataGrowZeroNoResize` (0 → no mp1 resize). RUNBOOK-provisioning-storage.md extended to the
+  three-volume layout (default ~512 GB SSD: 32 rootfs + 200 docker-data + 50 user-data).
+
 ## v0.39.0 — DR recipe completion: live PBS coord + drop the two unfillable drive fields (2026-06-16)
 
 **DR-recipe agent-half completion.** A live eyeball of the demo recipe (v0.38.0) found three host-half