v0.53.0: restore guests INTO the felhom pool (pool-scoped-ACL enabler)

RestoreLXCOptions.Pool → pct restore --pool (omit-when-empty). New
reconcile.DefaultPool="felhom"; BringUpSpec.Pool threaded to the bring-up
restore; BOTH restore sites pool the guest (provision/DR via spec.Pool set to
DefaultPool by the CLI; restore-test scratch via DefaultPool = SPIKE residual
#2). No agent ACL change (ships in host-install v1.6.0); the pool param is inert
until the token has Pool.Allocate + the pool exists, so publishing is safe ahead
of the coordinated swap. Tests + red-proofs; go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/bringup.go

@@ -43,6 +43,12 @@ const bringUpKind = "bring_up"
 // DefaultDataVolMount is the mpN slot the golden bakes the Docker-data volume (/var/lib/docker) at.
 const DefaultDataVolMount = "mp0"
 
+// DefaultPool is the PVE pool every Felhom-managed guest is restored INTO. Under the pool-scoped agent
+// token, restore-into-pool is how a fresh vmid gets allocated (VM.Allocate + Pool.Allocate at
+// /pool/felhom) and how the guest becomes reachable by the scoped token (SPIKE-pool-scoped-acl-2026-07-01).
+// Single source of truth for both restore sites (provision bring-up + restore-test).
+const DefaultPool = "felhom"
+
 // DefaultSysDataMount is the mpN slot the golden bakes the SSD user-data volume (/mnt/sys_drive) at.
 // This is the controller's system_data_path; provision grows it (SysDataGrowGB) like the Docker-data
 // volume. mp1 is the natural next bring-up slot (mp8/mp9 are added by the provision back-half).
@@ -76,6 +82,7 @@ type BringUpSpec struct {
 	VMID           int           // caller-provided target VMID (NOT the restore-test band / 9999)
 	RestoreStorage string        // rootfs target storage
 	Hostname       string        // hostname to set (provision); ignored for DR (continuity)
+	Pool           string        // restore the guest INTO this PVE pool ("" = none); required under a pool-scoped token
 	Cores          int           // 0 = leave as restored
 	MemoryMB       int           // 0 = leave as restored
 	RootfsGrowGB   int           // optional grow-only rootfs resize (0 = skip)
@@ -200,7 +207,7 @@ func (e *Engine) runBringUp(ctx context.Context, spec BringUpSpec, res *BringUpR
 
 	// 1. Restore archive → VMID (token-covered ClassCreate; keyctl preserved — phase3 + spike).
 	upid, err := e.api.RestoreLXC(ctx, proxmox.RestoreLXCOptions{
-		VMID: spec.VMID, Archive: spec.Archive, Storage: spec.RestoreStorage,
+		VMID: spec.VMID, Archive: spec.Archive, Storage: spec.RestoreStorage, Pool: spec.Pool,
 	})
 	if err != nil {
 		res.Err = fmt.Errorf("reconcile: bring-up restore: %w", err)