agent v0.37.0: host-reboot remount re-resolves enrolled drives by fs-UUID

TASK A — close out the reboot story (agent half). Root cause (pinned live on
felhom-pve): an enrolled .mount unit left `disabled` by a prior detach never
auto-mounts at boot, and kernel re-enumeration can move a drive's node
(/dev/sdb->sdc). Fix re-asserts every enrolled mount by filesystem UUID at
startup + on the periodic tick.

- ResolveStorageDevice: resolve uuid:<fs-uuid> -> current /dev node via
  /dev/disk/by-uuid (never a cached node); errors if absent.
- parseFelhomMountUnit: pure inverse of renderMountUnit (marker-gated).
- (*SudoHostOps).ReassertEnrolledMounts: re-run EnsureMount (enable --now) for
  any enrolled unit not in /proc/mounts; idempotent, skips mounted/absent.
- main.go: runs before ReassertGuestBinds at startup + on the 20s tick.
- tests (Linux, seam=device resolution): letter-move tolerated (sdb->sdc) +
  red-proof companion, absent/scheme rejection, render->parse round-trip.

TASK A2 verdict: enrolling a NEW drive does NOT need an LXC restart — the path
lands on the live AttachDrive (shared parent, named live slots), not RebootGuest.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/storage/durable_device_test.go

@@ -46,6 +46,84 @@ func withDevDiskRoot(t *testing.T, root string) {
 	t.Cleanup(func() { devDiskRoot = old })
 }
 
+// TestResolveStorageDevice_ToleratesDeviceLetterMove (Task A): on a host reboot the kernel can move a
+// drive from /dev/sdb to /dev/sdc; ResolveStorageDevice re-resolves the enrolled durable-id by filesystem
+// UUID and returns the CURRENT node, so the reshuffle is a no-op. COMPANION: a node-based resolver (what
+// the broken remount effectively did — trust the enroll-time node) returns the STALE node → the WRONG
+// device once the letter moves.
+func TestResolveStorageDevice_ToleratesDeviceLetterMove(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("symlink-based device resolution runs on Linux (the agent's OS)")
+	}
+	base := t.TempDir()
+	sdb := filepath.Join(base, "sdb") // the enroll-time node (now holds some OTHER drive after reboot)
+	sdc := filepath.Join(base, "sdc") // where felhom-usb's UUID now lives after re-enumeration
+	if err := os.WriteFile(sdb, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(sdc, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	root := filepath.Join(base, "disk")
+	if err := os.MkdirAll(filepath.Join(root, "by-uuid"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	const uuid = "da9e7089-cf8e-4617-adcb-a377743fae00"
+	if err := os.Symlink(sdc, filepath.Join(root, "by-uuid", uuid)); err != nil { // moved: UUID → sdc
+		t.Fatal(err)
+	}
+	withDevDiskRoot(t, root)
+
+	// FIX: resolve by UUID → the CURRENT node (sdc), tolerating the move.
+	got, err := ResolveStorageDevice("uuid:" + uuid)
+	if err != nil {
+		t.Fatalf("ResolveStorageDevice: %v", err)
+	}
+	wantSdc, _ := filepath.EvalSymlinks(sdc)
+	if got != wantSdc {
+		t.Fatalf("resolved %q, want the CURRENT node %q (the UUID moved sdb→sdc)", got, wantSdc)
+	}
+
+	// COMPANION: a node-based remount that trusts the recorded enroll-time node (sdb) now targets the
+	// WRONG device — sdb is no longer where this UUID lives.
+	cachedNode, _ := filepath.EvalSymlinks(sdb)
+	if cachedNode == got {
+		t.Fatalf("companion: the cached enroll-time node must differ from the freshly-resolved device after a move (cached=%q resolved=%q)", cachedNode, got)
+	}
+}
+
+// TestResolveStorageDevice_AbsentAndScheme: a vanished UUID errors (so the re-assert skips a gone drive),
+// and only the uuid: scheme is resolvable (never a bare /dev node — the anti-node-binding invariant).
+func TestResolveStorageDevice_AbsentAndScheme(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("linux")
+	}
+	withDevDiskRoot(t, filepath.Join(t.TempDir(), "empty"))
+	if _, err := ResolveStorageDevice("uuid:gone-uuid"); err == nil {
+		t.Fatal("an absent UUID must error so the re-assert skips a gone drive instead of fail-mounting")
+	}
+	for _, id := range []string{"/dev/sdb1", "store:felhom-usb", "byid:wwn-x", ""} {
+		if _, err := ResolveStorageDevice(id); err == nil {
+			t.Errorf("ResolveStorageDevice(%q) must reject a non-uuid: scheme", id)
+		}
+	}
+}
+
+// TestParseFelhomMountUnit round-trips renderMountUnit → parseFelhomMountUnit and rejects foreign units.
+func TestParseFelhomMountUnit(t *testing.T) {
+	spec := MountSpec{Name: "felhom-usb", UUID: "da9e7089-cf8e-4617-adcb-a377743fae00", Where: "/mnt/felhom-usb", FSType: "ext4"}
+	got, ok := parseFelhomMountUnit(renderMountUnit(spec))
+	if !ok {
+		t.Fatal("our own rendered unit must parse")
+	}
+	if got.Name != spec.Name || got.UUID != spec.UUID || got.Where != spec.Where || got.FSType != spec.FSType {
+		t.Fatalf("round-trip mismatch: got %+v want %+v", got, spec)
+	}
+	if _, ok := parseFelhomMountUnit("[Mount]\nWhat=/dev/sdb1\nWhere=/mnt/x\n"); ok {
+		t.Fatal("a non-felhom unit (no marker, not by-uuid) must not parse")
+	}
+}
+
 // DeviceDurableID prefers a wwn- by-id link over ata-/serial links and over a uuid.
 func TestDeviceDurableID_PrefersWWN(t *testing.T) {
 	root, device := fakeDevDisk(t,