restore-test: verdict is liveness, not start-task exitstatus (v0.7.0)

Fixes the crying-wolf false-fail surfaced by the live hub-enrollment runbook:
PVE's guest-start task exits "WARNINGS: 1" for the benign systemd-nesting
advisory, and WaitTask treated any non-OK exitstatus as failure, so the verdict
was decided by an advisory exit code before the real boot check ran. Every
modern-distro restore-test reported pass:false.

- proxmox.WaitOptions.AllowWarnings (opt-in; default keeps all callers strict)
- restore-test start step accepts warnings, surfaces them, verdict stays waitRunning
- RestoreTestResult.StartWarnings/.WarningsRecognized + version-free "enable
  nesting" recognizer (can't rot back at systemd 258+); GuestAPI.TaskLogTail
- hub.RestoreTest.warnings/.warnings_recognized wire fields (consumed by hub v0.7.5)
- scheduler logs clean / passed-with-recognized / passed-with-unrecognized warnings
- tests: WaitTask warnings matrix; restore-test pass/fail-on-liveness; version-free
  regression guard (systemd 256-300)

Single agent bump 0.6.0 -> 0.7.0 covering the agent half of both task phases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/report.go

@@ -196,6 +196,14 @@ type RestoreTest struct {
 	Error           string  `json:"error,omitempty"`
 	TestedAt        string  `json:"tested_at"` // RFC3339
 	DurationSeconds float64 `json:"duration_seconds"`
+	// Warnings are the guest-start task's warning line(s) (e.g. the systemd-nesting advisory).
+	// Present on a PASS that emitted warnings; pass/fail itself is liveness-only, so a passed
+	// restore-test can carry warnings. Omitted when there are none.
+	Warnings []string `json:"warnings,omitempty"`
+	// WarningsRecognized is true iff every Warnings line is the known-benign anchor. Omitted
+	// (⇒ false) when absent — and false is the SAFE default: the hub then treats it as an
+	// unrecognized warning (louder), so a missing flag can only over-notice, never hide.
+	WarningsRecognized bool `json:"warnings_recognized,omitempty"`
 }
 
 // PBSSnapshot is one PBS (offsite) snapshot's inventory + integrity state (doc 03 §8, slice