sudoers: close non-root allowlist gaps (lxc-info, make-private, restart dnsmasq, pct reboot/onboot) — restores multi-drive

Root cause of multi-drive flapping: lxc-info absent from the allowlist → empty guest
PID → bound_under_parent=false for every drive → controller gate stops apps. Audit-driven
completeness pass; surfaces GuestExec/pct-exec (controller-swap) for operator decision.
No binary change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

configs/felhom-agent.sudoers

@@ -34,7 +34,8 @@ Cmnd_Alias FELHOM_DISK = \
 # writes there is the only thing these touch. ':' is escaped per sudoers grammar.
 Cmnd_Alias FELHOM_PROVISION = \
   /usr/bin/chown -R 100000\:100000 /var/lib/felhom-agent/guests/*, \
-  /usr/sbin/pct set [0-9]* -mp[0-9]* /var/lib/felhom-agent/guests/*
+  /usr/sbin/pct set [0-9]* -mp[0-9]* /var/lib/felhom-agent/guests/*, \
+  /usr/sbin/pct set [0-9]* -onboot 1
 
 # Disk inspection + format (slice 8C). blkid/lsblk read the device's data-bearing evidence (the
 # agent decides data-bearing-ness from THIS, never the caller's claim); mkfs.* formats a device the
@@ -57,6 +58,7 @@ Cmnd_Alias FELHOM_DNSMASQ = \
   /usr/bin/install -m 0644 /tmp/felhom-resolver-*.conf /etc/dnsmasq.d/felhom-*.conf, \
   /usr/bin/systemctl enable --now dnsmasq, \
   /usr/bin/systemctl reload dnsmasq, \
+  /usr/bin/systemctl restart dnsmasq, \
   /usr/bin/rm -f /etc/dnsmasq.d/felhom-*.conf, \
   /usr/sbin/pct exec [0-9]* -- ip -4 -o addr show dev eth0, \
   /usr/sbin/pct exec [0-9]* -- docker exec felhom-controller cat /opt/docker/felhom-controller/controller.yaml
@@ -69,13 +71,19 @@ Cmnd_Alias FELHOM_DNSMASQ = \
 Cmnd_Alias FELHOM_GUESTHOOK = \
   /usr/bin/install -m 0755 -- /tmp/felhom-guest-hook.sh /var/lib/vz/snippets/felhom-guest-hook.sh, \
   /usr/sbin/pct set [0-9]* --hookscript local\:snippets/felhom-guest-hook.sh, \
-  /usr/sbin/pct set [0-9]* --delete mp[0-9]*
+  /usr/sbin/pct set [0-9]* --delete mp[0-9]*, \
+  /usr/sbin/pct reboot [0-9]*
 
 # Intermediary mount model (the drive hot-swap re-architecture). The agent keeps a SHARED host parent
 # /mnt/felhom-drives (self-bind + make-shared + a boot-persistence systemd unit) and binds/unbinds each
 # drive's felhom-data namespace UNDERNEATH it so the change propagates into the running guest live (no
 # pct, no reboot). The agent fine-validates the drive name + confines paths before any exec; the trailing
 # `*` (matching the comma-laden mp spec) mirrors the existing FELHOM_PROVISION pattern.
+# `lxc-info -n <vmid> -p -H` resolves the guest init PID for the GuestSeesMount / bound_under_parent check
+# (a READ — the drive-gate's "is the drive live in the guest?" signal); WITHOUT it the non-root agent gets
+# an empty PID and reports every drive absent (multi-drive flapping, audit 2026-06-29). `make-private`
+# isolates the parent's peer group on FIRST setup only (EnsureSharedParent guards on mountpoint, so it
+# never re-churns a live parent); without it the parent stays in root's group and submounts double.
 Cmnd_Alias FELHOM_INTERMEDIARY = \
   /usr/bin/mkdir -p /mnt/felhom-drives, \
   /usr/bin/mkdir -p /mnt/felhom-drives/*, \
@@ -83,11 +91,13 @@ Cmnd_Alias FELHOM_INTERMEDIARY = \
   /usr/bin/chown 100000\:100000 /mnt/*/felhom-data, \
   /usr/bin/mount --bind /mnt/felhom-drives /mnt/felhom-drives, \
   /usr/bin/mount --make-shared /mnt/felhom-drives, \
+  /usr/bin/mount --make-private /mnt/felhom-drives, \
   /usr/bin/mount --bind /mnt/*/felhom-data /mnt/felhom-drives/*, \
   /usr/bin/umount /mnt/felhom-drives/*, \
   /usr/bin/install -m 0755 -- /tmp/felhom-shared-parent.sh /usr/local/sbin/felhom-shared-parent.sh, \
   /usr/bin/install -m 0644 -- /tmp/felhom-shared-parent.service /etc/systemd/system/felhom-shared-parent.service, \
   /usr/bin/systemctl enable felhom-shared-parent.service, \
+  /usr/bin/lxc-info -n [0-9]* -p -H, \
   /usr/sbin/pct set [0-9]* -mp8 /mnt/felhom-drives*
 
 felhom-agent ALL=(root) NOPASSWD: FELHOM_MOUNT, FELHOM_DISK, FELHOM_PROVISION, FELHOM_FORMAT, FELHOM_DNSMASQ, FELHOM_GUESTHOOK, FELHOM_INTERMEDIARY