GL-5b: restore-test full-fidelity verification (v0.76.0)

The restore-test had GL-5 finding #2's mirror image: its live-source-config
bind-override path tripped PVE's drop-unlisted-mountpoints rule, so scratch
guests boot-verified WITHOUT their storage mpN - weaker verification than
claimed. Params now derive from the ARCHIVE's own embedded config via
ExtractArchiveConfig + drRestoreOverrides (the object under test; full
layout, content genuinely extracted - the added runtime IS the
verification); unreadable/unknown-topology archives refuse up front. NEW
mount-parity assert (2b, pre-start): restored mpN set vs the archive's -
missing/mispathed/undersized/extra mpN fail the test naming the delta, so
constraint (b) can never regress into a green light. MountParity +
MountInventory ride the result + hub wire record (additive). Dead
bindMountOverrides/archiveVMID path deleted with its tests (no reachable
lookalike). DR bring-up untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/hub/report.go

@@ -304,6 +304,11 @@ type RestoreTest struct {
 	// (⇒ false) when absent — and false is the SAFE default: the hub then treats it as an
 	// unrecognized warning (louder), so a missing flag can only over-notice, never hide.
 	WarningsRecognized bool `json:"warnings_recognized,omitempty"`
+	// MountParity ("ok"|"mismatch"; omitted on pre-v0.76.0 agents) + MountInventory (the verified
+	// mpN set) carry the GL-5b full-fidelity proof: the restored scratch matched the ARCHIVE's
+	// mount layout, not just booted. Additive — a hub that predates them ignores the unknown keys.
+	MountParity    string   `json:"mount_parity,omitempty"`
+	MountInventory []string `json:"mount_inventory,omitempty"`
 }
 
 // PBSSnapshot is one PBS (offsite) snapshot's inventory + integrity state (doc 03 §8, slice