restore-test: verdict is liveness, not start-task exitstatus (v0.7.0)

Fixes the crying-wolf false-fail surfaced by the live hub-enrollment runbook:
PVE's guest-start task exits "WARNINGS: 1" for the benign systemd-nesting
advisory, and WaitTask treated any non-OK exitstatus as failure, so the verdict
was decided by an advisory exit code before the real boot check ran. Every
modern-distro restore-test reported pass:false.

- proxmox.WaitOptions.AllowWarnings (opt-in; default keeps all callers strict)
- restore-test start step accepts warnings, surfaces them, verdict stays waitRunning
- RestoreTestResult.StartWarnings/.WarningsRecognized + version-free "enable
  nesting" recognizer (can't rot back at systemd 258+); GuestAPI.TaskLogTail
- hub.RestoreTest.warnings/.warnings_recognized wire fields (consumed by hub v0.7.5)
- scheduler logs clean / passed-with-recognized / passed-with-unrecognized warnings
- tests: WaitTask warnings matrix; restore-test pass/fail-on-liveness; version-free
  regression guard (systemd 256-300)

Single agent bump 0.6.0 -> 0.7.0 covering the agent half of both task phases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/state.go

@@ -126,6 +126,10 @@ type GuestAPI interface {
 	// TaskStatusOnce is a single non-blocking task-status read — used by crash
 	// recovery to learn the outcome of an op that was in flight when the agent died.
 	TaskStatusOnce(ctx context.Context, upid string) (proxmox.TaskStatus, error)
+	// TaskLogTail fetches up to limit trailing task-log lines — used to surface a guest-start
+	// task's warning text (the restore-test fetches it when the start exits "WARNINGS: N", so
+	// the advisory is reported without failing a guest that actually boots).
+	TaskLogTail(ctx context.Context, upid string, limit int) ([]string, error)
 }
 
 // guestDescription decodes the (string-valued) `description` key from a GuestConfig's