R-528: GET /guest/oom-kills — the kernel's per-container OOM counter of the token's guest, read on the host (no sudo)

Tests TestR528_* (fake cgroup tree), red-proved by mutation. Commit only; the agent release needs the vouch.

internal/localapi/server.go

@@ -459,6 +459,8 @@ type Server struct {
 	escrowLookPath func(file string) (string, error)
 	// statFile reports whether a path exists (preflight's staged-secret item; tests inject).
 	statFile func(path string) bool
+	// cgroupRoot is where the host's cgroup tree is mounted (R-528, GET /guest/oom-kills); "" = /sys/fs/cgroup. Tests set it.
+	cgroupRoot string
 
 	baseCtx context.Context // for fire-and-forget backups; set in Run
 }
@@ -576,6 +578,9 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /host/crash-guard", s.withGuest(s.handleCrashGuard))
 	// R-1247: the weekly upload line test's last measurement — the controller's qBittorrent limit and upload watch
 	// read it. Read-only; never measured (or the job not wired) = present:false.
+	// R-528: the kernel's OOM-kill counter of each of the guest's containers, read on the host (Docker's own flag and
+	// event can stay silent inside an LXC guest). Read-only; the asking guest's containers only.
+	mux.HandleFunc("GET /guest/oom-kills", s.withGuest(s.handleGuestOOMKills))
 	mux.HandleFunc("GET /host/line-test", s.withGuest(s.handleLineTest))
 	mux.HandleFunc("POST /host/line-test/run", s.withGuest(s.handleLineTestRun)) // R-1250: a test on request
 	// Disk management (slice 8C) — self-scoped; format routes through the data-bearing classifier+gate.