v0.113.0 — E-2a: guarded backup-target wrapper + POST /backup/target

The agent cannot create a PVE storage (Datastore.Allocate at /storage) or grant
an ACL (Permissions.Modify) -- it holds neither by design, and widening the role
would trade the whole blast-radius containment model for one feature. The
privileged half therefore lives in a new fenced shim behind a literal
FELHOM_BACKUPTARGET sudoers alias, following the mkfs/pbs-apply pattern.

The wrapper enforces the two laws E-1 paid for on live hardware so no caller can
forget them: F-1 the path must BE the drive's own mountpoint, F-2 is_mountpoint 1
is hardcoded rather than a caller flag. It refuses a root-device target, has NO
storage-removal path of any kind (the pbs-apply no-delete law, grep-assertable),
is idempotent for the same path, and REFUSES to repoint an existing id.

POST /backup/target drives it in a fixed order: create -> grant -> config.
Reversed, a config pointing at an ungranted storage 403s every backup on first
run -- exactly E-1 finding F-3. A failed grant leaves the config untouched.

It deliberately does NOT restart the agent: restarting with a backup in flight
cancels the wait and records a spurious tier failure for a backup that actually
succeeded (E-1 did this to a real felhom-pbs run). It returns restart_required
and the caller restarts behind its own immediate in-flight check.

Config rewrite preserves unknown keys verbatim and writes in place, since
/etc/felhom-agent is root-owned while agent.json is agent-owned 0600.

Green gate: build + vet + test rc=0 (29 packages), run separately from this commit.

internal/localapi/server.go

@@ -34,6 +34,12 @@ type GuestAPI interface {
 	WaitTask(ctx context.Context, upid string, opts proxmox.WaitOptions) (proxmox.TaskStatus, error)
 }
 
+// PrivilegedRunner runs a fenced root wrapper. The seam exists so the backup-target move is testable
+// without sudo: the wrapper IS the security boundary, so tests substitute it, never bypass it.
+type PrivilegedRunner interface {
+	Run(ctx context.Context, name string, args ...string) (stdout, stderr []byte, err error)
+}
+
 // BackupService enqueues a vzdump/PBS backup of a guest. Satisfied by *backup.BackupRunner.
 // BackupWithSnapshotHook (8B.2) invokes onSnapshot once mid-backup when the storage snapshot is
 // taken (snapshot mode only) so the controller can resume its app early; in stop mode it is never
@@ -146,6 +152,14 @@ type Options struct {
 	// NetStorage is the privileged network-mount (NAS) surface (Part A1). OPTIONAL — when nil, the
 	// /netstorage endpoints report "not configured". Satisfied by *storage.SudoHostOps.
 	NetStorage NetworkStorageOps
+	// Privileged runs the fenced root wrappers (E-2a: felhom-backup-target-apply). OPTIONAL — when
+	// nil, POST /backup/target reports "not configured". Satisfied by *proxmox.ExecRunner.
+	Privileged PrivilegedRunner
+	// ConfigPath is agent.json, so the backup-target move can repoint the primary tier. "" (env-only
+	// config) → the move reports it cannot persist rather than pretending it did.
+	ConfigPath string
+	// StateDir is where a pre-write recovery copy of agent.json is parked. "" → no copy is parked.
+	StateDir string
 	// SmbCredsDir is where the agent writes the 0600 SMB credentials files (out-of-band). "" →
 	// /var/lib/felhom-agent/smb-creds.
 	SmbCredsDir string
@@ -340,6 +354,9 @@ type Server struct {
 	escrowDone     <-chan struct{} // closes when the detached job finishes (tests wait on it)
 	// ceremonyRun executes the fixed-argv sudo self-invocation (tests inject canned JSON).
 	ceremonyRun ceremonyRunner
+	privileged  PrivilegedRunner
+	configPath  string
+	stateDir    string
 	// escrowSudoCheck is the preflight's list-mode grant probe (`sudo -n -l -- <argv>`).
 	escrowSudoCheck func(ctx context.Context) error
 	// escrowLookPath resolves a binary on PATH for preflight (tests inject).
@@ -384,6 +401,9 @@ func NewServer(o Options) (*Server, error) {
 		guestAttach:     o.GuestAttach,
 		mem:             o.Memory,
 		netStorage:      o.NetStorage,
+		privileged:      o.Privileged,
+		configPath:      o.ConfigPath,
+		stateDir:        o.StateDir,
 		netMountRoot:    storage.NetworkMountRoot,
 		smbCredsDir:     o.SmbCredsDir,
 		escrowStagePath: o.EscrowStagePath,
@@ -442,6 +462,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /backup", s.withGuest(s.handleBackup))
 	mux.HandleFunc("GET /backup/due", s.withGuest(s.handleBackupDue))
 	mux.HandleFunc("GET /backup/tiers", s.withGuest(s.handleBackupTiers))
+	mux.HandleFunc("POST /backup/target", s.withGuest(s.handleSetBackupTarget))
 	mux.HandleFunc("GET /backup/status", s.withGuest(s.handleBackupStatus))
 	mux.HandleFunc("GET /restore-test/status", s.withGuest(s.handleRestoreTestStatus))
 	// Host metrics (slice 9): host-wide health + per-storage capacity for the customer's monitoring