v0.5.0: slice 5 Phase B — the host-root surface (mounts + SMART + grow + destructive gate)

The privileged write surface, isolated behind a narrow, arg-validated, adversarially-
tested seam (HostOps), the same discipline as the slice-4 gate. Completes slice 5.

- internal/storage: HostOps seam + SudoHostOps (systemd .mount units by fs-UUID, detach,
  SMART, lvs) via sudoers allowlist + fixed arg vectors, no shell; NoopHostOps fallback.
- validate.go: strict UUID/mount-path/device/LVM validators + in-process systemd-escape.
  Headline test: adversarial matrix (metacharacters/traversal/malformed) refused with
  zero exec.
- smart.go: smartctl SATA + NVMe parse, UNKNOWN-degrade; lvs thin-pool metadata fill.
- observer enrichment (Observe only): fills smart + thin-pool metadata.
- watchdog: benign re-mount response off the poll path (DevicePresent probe, rate-limited).
- reconcile: ActionResize (benign, grow-only) + proxmox.ResizeLXC; destructive storage ops
  (ClassStorageWipe/Decommission) through the slice-4 gate, target-scoped; built+tested,
  inert live.
- --selftest=storage [-watch] live harness; configs/felhom-agent.sudoers; privileged.* knobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -116,12 +116,22 @@ type TLSTrust struct {
 	InsecureSkipVerify bool   `json:"insecure_skip_verify"` // off by default; selftest-only
 }
 
-// PrivilegedConfig configures the fenced root-CLI runner.
+// PrivilegedConfig configures the fenced root-CLI runner and the slice-5 HostOps surface
+// (systemd mount units + smartctl + lvs). The binary paths must match the sudoers allowlist
+// exactly (see configs/felhom-agent.sudoers).
 type PrivilegedConfig struct {
 	// Mode: "sudo" (default — non-root agent + narrow sudoers) or "direct".
 	Mode string `json:"mode"`
 	// SudoPath overrides the sudo binary (default "sudo").
 	SudoPath string `json:"sudo_path"`
+
+	// HostOps (slice 5 Phase B) — the privileged storage write/read surface.
+	UnitDir   string `json:"unit_dir"`  // where enabled .mount units live (default /etc/systemd/system)
+	StageDir  string `json:"stage_dir"` // agent-owned staging dir for unit files (default /var/lib/felhom-agent/units)
+	Systemctl string `json:"systemctl"` // default /usr/bin/systemctl
+	Install   string `json:"install"`   // default /usr/bin/install
+	Smartctl  string `json:"smartctl"`  // default /usr/sbin/smartctl
+	Lvs       string `json:"lvs"`       // default /usr/sbin/lvs
 }
 
 // Default returns a Config pre-populated with sane defaults.