v0.81.0: NAS verify-before-commit — retry=0, journal classifier, detached verify job + auto-rollback

Agent half of the verify-before-commit task (SPIKE-nas-verify-2026-07-11, b57f6c1):
retry=0 in the production NFS options (Q4-vi); ClassifyNetVerifyFailure on the live
Q4 strings (nfs_export merges not-found/not-permitted); add = sync fast-fail (2s TCP
pre-probe, nothing installed) + detached in-memory verify job judging /proc/mounts
only, auto-rollback on failure; GET /netstorage/verify-status (phase none = the
controller's Scenario-F rollback signal); unprivileged journalctl (systemd-journal
group, NO new sudoers grants).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/localapi/netstorage_test.go

@@ -51,6 +51,12 @@ func newNetServer(t *testing.T, n NetworkStorageOps, credsDir string) *Server {
 	if err != nil {
 		t.Fatalf("new server: %v", err)
 	}
+	// Hermetic verify seams: no TCP dial, no /proc/mounts, no journalctl. Verify-specific tests
+	// (netverifyjob_test.go) override the rows they exercise.
+	srv.netReachable = func(storage.NetworkProtocol, string) bool { return true }
+	srv.netTrigger = func(string) error { return nil }
+	srv.netMounted = func(string) bool { return true }
+	srv.netJournal = func(context.Context, string) (string, error) { return "", nil }
 	return srv
 }