v0.53.0: restore guests INTO the felhom pool (pool-scoped-ACL enabler)

RestoreLXCOptions.Pool → pct restore --pool (omit-when-empty). New
reconcile.DefaultPool="felhom"; BringUpSpec.Pool threaded to the bring-up
restore; BOTH restore sites pool the guest (provision/DR via spec.Pool set to
DefaultPool by the CLI; restore-test scratch via DefaultPool = SPIKE residual
#2). No agent ACL change (ships in host-install v1.6.0); the pool param is inert
until the token has Pool.Allocate + the pool exists, so publishing is safe ahead
of the coordinated swap. Tests + red-proofs; go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/restoretest.go

@@ -192,7 +192,9 @@ func (e *Engine) runScratchTest(ctx context.Context, vmid int, spec RestoreTestS
 		}
 	}
 	upid, err := e.api.RestoreLXC(ctx, proxmox.RestoreLXCOptions{
-		VMID: vmid, Archive: spec.Archive, Storage: spec.RestoreStorage, MountOverrides: mountOverrides,
+		// Pool=DefaultPool so the scratch guest is created INTO the felhom pool — else a pool-scoped
+		// token 403s on the scratch guest's config/start/destroy (SPIKE residual #2).
+		VMID: vmid, Archive: spec.Archive, Storage: spec.RestoreStorage, MountOverrides: mountOverrides, Pool: DefaultPool,
 	})
 	if err != nil {
 		res.Err = fmt.Errorf("reconcile: restore-test restore: %w", err)