v0.53.0: restore guests INTO the felhom pool (pool-scoped-ACL enabler)

RestoreLXCOptions.Pool → pct restore --pool (omit-when-empty). New
reconcile.DefaultPool="felhom"; BringUpSpec.Pool threaded to the bring-up
restore; BOTH restore sites pool the guest (provision/DR via spec.Pool set to
DefaultPool by the CLI; restore-test scratch via DefaultPool = SPIKE residual
#2). No agent ACL change (ships in host-install v1.6.0); the pool param is inert
until the token has Pool.Allocate + the pool exists, so publishing is safe ahead
of the coordinated swap. Tests + red-proofs; go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/proxmox/mutate.go

@@ -34,6 +34,11 @@ type RestoreLXCOptions struct {
 	Archive string // source archive volid, e.g. "local:backup/vzdump-lxc-9001-...tar.zst"
 	Storage string // target storage for the rootfs, e.g. "local-lvm"
 	Force   bool   // overwrite an existing VMID (destructive — caller must have authority)
+	// Pool allocates the restored guest INTO a PVE pool (pct restore --pool). "" = no pool. Under a
+	// pool-scoped token this is REQUIRED for the restore to authorize (VM.Allocate + Pool.Allocate are
+	// granted at /pool/<pool>, not /), and it makes the guest reachable by the scoped token afterwards
+	// (SPIKE-pool-scoped-acl-2026-07-01). Empty is valid — a broad-token restore needs no pool.
+	Pool string
 	// MountOverrides overrides specific mountpoints at restore time (mpN -> full value, e.g.
 	// "local-lvm:1,mp=/data,backup=0"). A restore param takes precedence over the archive's own
 	// mpN. The restore-test uses this to neutralize a SOURCE host bind-mount mountpoint (slice-10
@@ -59,6 +64,9 @@ func (c *Client) RestoreLXC(ctx context.Context, opts RestoreLXCOptions) (string
 	if opts.Force {
 		v.Set("force", "1")
 	}
+	if opts.Pool != "" {
+		v.Set("pool", opts.Pool) // allocate into the pool (pool-scoped token needs this — see RestoreLXCOptions.Pool)
+	}
 	for k, val := range opts.MountOverrides {
 		v.Set(k, val) // e.g. mp0 -> "local-lvm:1,mp=/data,backup=0" (overrides the archive's mp0)
 	}