slice 8B.2 (agent): emit snapshotted phase at storage-snapshot moment (v0.13.0)

BackupRunner.BackupWithSnapshotHook tails the task log for the 'create storage
snapshot' marker (snapshot mode only) and fires onSnapshot once; localapi flips
/backup/status to 'snapshotted' before 'done' so the controller resumes early.
Phase 0 validated on PVE 9.2.2: marker confirmed, downtime ~24s->~1s (934MB).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

configs/build-golden.sh

@@ -87,6 +87,10 @@ IMAGE=$(cat /etc/felhom-controller-image 2>/dev/null || true)
 [ -n "$IMAGE" ] || { echo "[ctrl-bootstrap] FATAL: /etc/felhom-controller-image missing"; exit 1; }
 echo "[ctrl-bootstrap] deploying $IMAGE from $CFG"
 docker rm -f felhom-controller >/dev/null 2>&1 || true
+# slice 8C: the controller is DE-PRIVILEGED — disk execution (scan/format/mount/migrate) is the
+# host agent's job now, so this run grants NO disk privileges: no --privileged, no /dev, no
+# /etc/fstab, no rshared /mnt. Only the bootstrap config (ro), the data volume, and the docker
+# socket (app/stack management). The controller reaches the agent's local API for disk management.
 docker run -d --name felhom-controller --restart unless-stopped \
   -e FELHOM_BOOTSTRAP_PATH=/etc/felhom-bootstrap/bootstrap.json \
   -v /etc/felhom-bootstrap:/etc/felhom-bootstrap:ro \