v0.22.0: expose durable_id in GET /disks (enables controller guided storage)

localapi.DiskInfo gains durable_id (from StorageTarget.DurableID, "uuid:<fs-uuid>"
for usb/local-dir). The de-privileged controller can't read a device's fs UUID
but assign mounts strictly by UUID — this read-only field is the only way it
learns the assign key. No new privilege, no gate change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/localapi/disks.go

@@ -51,6 +51,10 @@ type DiskInfo struct {
 	Class         string `json:"class"`        // fast | slow | ""
 	DataBearing   bool   `json:"data_bearing"` // agent device-inspection verdict (UI hint)
 	DataReason    string `json:"data_reason,omitempty"`
+	// DurableID is the target's stable identity (e.g. "uuid:<fs-uuid>" for usb/local-dir). The
+	// controller strips the "uuid:" prefix to get the fs UUID it passes to POST /disks/assign —
+	// the only way the (de-privileged) controller can learn the mount key it cannot read itself.
+	DurableID string `json:"durable_id,omitempty"`
 }
 
 // handleDisks lists the host's drives + data-bearing flags (read-only/benign).
@@ -69,6 +73,7 @@ func (s *Server) handleDisks(w http.ResponseWriter, r *http.Request, vmid int) {
 		di := DiskInfo{
 			Name: t.Name, Type: t.Type, State: t.State,
 			BackingDevice: t.BackingDevice, MountPath: t.MountPath, Class: t.ClassHint,
+			DurableID: t.DurableID,
 		}
 		// Inspect the backing device for the UI's data-bearing hint (the authoritative check
 		// is re-run at format time on the actual device).