v0.84.0: ReassertNetworkMounts — NAS automount survives guest reboots (RCA fix 1)

Storage §8 decision table (stop + enable --now on idle triggers; active mounts untouched),
daemon leg at startup with per-running-guest visibility verify, guest-hook post-start leg
(root, direct systemctl, non-fatal). Red-proofs: always-rearm table FAIL; unwired hook FAIL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/guesthook/heal.go

@@ -30,6 +30,10 @@ import (
 // PhasePreStart is the PVE hook phase at which we self-heal (before the container mounts are set up).
 const PhasePreStart = "pre-start"
 
+// PhasePostStart is the PVE hook phase after the container started — the NAS automount reassert
+// point (the fresh guest namespace has no idle autofs triggers; see netreassert.go).
+const PhasePostStart = "post-start"
+
 // placeholderMode is the mode for a created bind-source placeholder. Host-root-owned + this mode =
 // fail-closed against the unprivileged guest (host uid 0 is unmapped in the guest userns).
 const placeholderMode = 0o755