v0.53.0: restore guests INTO the felhom pool (pool-scoped-ACL enabler)

RestoreLXCOptions.Pool → pct restore --pool (omit-when-empty). New
reconcile.DefaultPool="felhom"; BringUpSpec.Pool threaded to the bring-up
restore; BOTH restore sites pool the guest (provision/DR via spec.Pool set to
DefaultPool by the CLI; restore-test scratch via DefaultPool = SPIKE residual
#2). No agent ACL change (ships in host-install v1.6.0); the pool param is inert
until the token has Pool.Allocate + the pool exists, so publishing is safe ahead
of the coordinated swap. Tests + red-proofs; go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,3 +1,28 @@
+## v0.53.0 — restore guests INTO the felhom pool (pool-scoped-ACL enabler) (2026-07-01)
+
+Colleague-safety batch #4 phase b (agent half). Enables the agent token to be scoped from `/` to
+`/pool/felhom` + `/storage/<targets>` (real blast-radius containment on a shared host) by making every
+restore allocate the guest INTO the pool — the only way a fresh vmid authorizes under a pool-scoped
+token. Grounded by `felhom.eu/documentation/audits/SPIKE-pool-scoped-acl-2026-07-01.md` (PASS).
+
+- **`internal/proxmox/mutate.go`:** `RestoreLXCOptions` gains `Pool string`; `RestoreLXC` sends
+  `pool=<p>` only when non-empty (`pct restore --pool`). Omit-when-empty (a broad-token restore needs
+  no pool) — unit-tested + red-proofed.
+- **`internal/reconcile`:** new `const DefaultPool = "felhom"` (single source of truth); `BringUpSpec`
+  gains `Pool`, threaded to the bring-up restore. **Both restore sites** now pool the guest: the
+  provision/DR bring-up (`Pool: spec.Pool`, set to `DefaultPool` by the CLI) AND the **restore-test**
+  scratch guest (`Pool: DefaultPool`) — the latter closes SPIKE residual #2 (a pool-scoped token would
+  otherwise 403 on the out-of-pool scratch guest).
+- **`cmd/felhom-agent/main.go`:** both `BringUpSpec` literals (bring-up/DR + provision) set
+  `Pool: reconcile.DefaultPool`.
+- **No ACL/priv change in the agent** — that ships in the host-install script (v1.6.0). The pool param
+  is INERT until the token is granted `Pool.Allocate` at `/pool/felhom` and the pool exists; publishing
+  is therefore safe ahead of the coordinated ACL swap.
+- New tests: `proxmox.TestRestoreLXC_PoolParam` (set → `pool=felhom`; empty → omitted),
+  `reconcile.TestRestoreSitesUsePool` (both restore sites carry `DefaultPool`). Both red-proofed
+  (unconditional `Set` → omit test fails; drop either site's `Pool` → both-sites test fails). `go
+  build`/`vet`/`test ./...` clean.
+
 ## v0.52.0 — operator-opt-in CPU/RAM cap for the provisioned guest (`-cores` / `-memory`) (2026-07-01)
 
 Colleague-safety batch #3. So a trial appliance guest on a colleague's SHARED production Proxmox does