v0.81.0: NAS verify-before-commit — retry=0, journal classifier, detached verify job + auto-rollback

Agent half of the verify-before-commit task (SPIKE-nas-verify-2026-07-11, b57f6c1):
retry=0 in the production NFS options (Q4-vi); ClassifyNetVerifyFailure on the live
Q4 strings (nfs_export merges not-found/not-permitted); add = sync fast-fail (2s TCP
pre-probe, nothing installed) + detached in-memory verify job judging /proc/mounts
only, auto-rollback on failure; GET /netstorage/verify-status (phase none = the
controller's Scenario-F rollback signal); unprivileged journalctl (systemd-journal
group, NO new sudoers grants).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/storage/netmount_test.go

@@ -21,7 +21,7 @@ func TestNetworkMount_NFSUnitRendering(t *testing.T) {
 	}
 	mu := renderNetworkMountUnit(spec)
 
-	wantOpts := "Options=vers=4.1,soft,timeo=50,retrans=2,noatime,_netdev"
+	wantOpts := "Options=vers=4.1,soft,timeo=50,retrans=2,noatime,_netdev,retry=0"
 	for _, want := range []string{
 		netUnitMarker,
 		"What=192.168.0.180:/srv/nas-sim/media",