restore-test: verdict is liveness, not start-task exitstatus (v0.7.0)

Fixes the crying-wolf false-fail surfaced by the live hub-enrollment runbook:
PVE's guest-start task exits "WARNINGS: 1" for the benign systemd-nesting
advisory, and WaitTask treated any non-OK exitstatus as failure, so the verdict
was decided by an advisory exit code before the real boot check ran. Every
modern-distro restore-test reported pass:false.

- proxmox.WaitOptions.AllowWarnings (opt-in; default keeps all callers strict)
- restore-test start step accepts warnings, surfaces them, verdict stays waitRunning
- RestoreTestResult.StartWarnings/.WarningsRecognized + version-free "enable
  nesting" recognizer (can't rot back at systemd 258+); GuestAPI.TaskLogTail
- hub.RestoreTest.warnings/.warnings_recognized wire fields (consumed by hub v0.7.5)
- scheduler logs clean / passed-with-recognized / passed-with-unrecognized warnings
- tests: WaitTask warnings matrix; restore-test pass/fail-on-liveness; version-free
  regression guard (systemd 256-300)

Single agent bump 0.6.0 -> 0.7.0 covering the agent half of both task phases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,52 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## v0.7.0 — restore-test: verdict is liveness, not start-task exitstatus (2026-06-09)
+
+Fixes a correctness bug found by the live hub-enrollment runbook: the self-restore-test reported
+`pass:false` on **every** modern-distro guest. PVE's guest-start task exits `"WARNINGS: 1"` for the
+benign systemd-nesting advisory (`WARN: Systemd 257 detected. You may need to enable nesting.`), and
+`WaitTask` treated any non-`"OK"` exitstatus as a hard failure — so the verdict was decided by an
+advisory exit code instead of by observed liveness, *before* the real boot check ran. A crying-wolf
+test got it disabled on the demo host; this re-enables it. **Single bump (0.6.0→0.7.0) covering the
+agent's part of both task phases**; the wire fields below are consumed by hub from **v0.7.5**.
+
+Design invariant (in code): **warning classification affects *visibility only*; pass/fail is
+liveness-only.** A wrong/stale recognizer can at worst over-notice a benign warning — it can never
+false-fail and never hide a real warning.
+
+### Added
+- **`proxmox.WaitOptions.AllowWarnings`** — opt-in per call. When set, a task that completes
+  `"WARNINGS: N"` is success with the `TaskStatus` (ExitStatus intact) returned so the caller can
+  read/surface it. Default (`false`) keeps **every existing caller strict** (vzdump/restore/destroy
+  warnings can be meaningful — relaxing them is a future per-call decision with evidence). Any
+  non-WARNINGS non-OK exit is still a `*TaskError`.
+- **`reconcile.RestoreTestResult.StartWarnings` / `.WarningsRecognized`** + a version-free recognizer
+  (`benignWarningAnchor = "enable nesting"`, case-insensitive substring — contains no systemd version
+  number, so it can't rot back into the bug at systemd 258+). `extractWarningLines` pulls `WARN…`
+  lines from the start-task log.
+- **`reconcile.GuestAPI.TaskLogTail`** — the engine fetches the start task's log to surface warnings.
+- **`hub.RestoreTest.warnings` / `.warnings_recognized`** wire fields (`omitempty`), populated by
+  `ToHubRestoreTest`. Additive: the deployed v0.7.4 hub ignores them; hub v0.7.5 consumes them
+  (passed-with-warnings INFO, or WARN when not recognized). Cross-repo golden updated with the hub side.
+
+### Changed
+- **Restore-test start step** (`reconcile/restoretest.go`) now waits with `AllowWarnings:true`,
+  surfaces any start warnings, and **continues to `waitRunning` as the verdict** — boot+running is the
+  pass, exactly as before; a real (non-WARNINGS) start-task error still fails. The restore and
+  scratch-teardown WaitTasks stay strict.
+- **Restore-test scheduler logging** distinguishes a clean pass, *passed-with-recognized-warnings*
+  (INFO), and *passed-with-unrecognized-warnings* (WARN) — nothing silent.
+
+### Tests
+- `WaitTask`: AllowWarnings accepts `WARNINGS` (status returned intact); AllowWarnings still fails a
+  real error; default still fails on `WARNINGS` (existing callers unaffected).
+- Restore-test (engine, mock proxmox): start-with-warnings + running → **pass** with warnings
+  surfaced+recognized; unrecognized warning + running → pass, not-recognized; **not-running → fail
+  regardless of warnings** (verdict is liveness); teardown still runs.
+- **Regression guard:** the `"enable nesting"` recognizer matches the advisory for systemd 256–300,
+  proving it's version-independent and can't silently rot back into the false-fail.
+
 ## v0.6.0 — slice 6 Phase B: PBS offsite tier (verify + PBS-API client + reporting) (2026-06-09)
 
 Completes slice 6. The PBS spike (felhom.eu phase5-pbs-spike-findings.md) proved backup-to-PBS