v0.6.0-rc1: slice 6 Phase A — backup + the self-restore-test (local target)

The guest-level backup layer + the journaled self-restore-test (restore→boot→verify→
teardown) that closes "a backup you haven't restored isn't a backup". All benign
(reuses the slice-4 classifier/gate/journal; no new destructive class/crypto). Local
target only; PBS = Phase B. Restore to a NEW guest only. Backups crash-consistent.

- proxmox: DestroyLXC, VzdumpOptions.Notes (notes-template), LatestBackupVolID.
- reconcile: Engine.RunRestoreTest (journal Scratch entry BEFORE mutation; net link-down
  pre-boot; defer teardown always; benign gated destroy) + Recover extended to reap a
  leaked scratch guest (Scratch flag, special-cased before the UPID path; idempotent).
- internal/backup: runner (vzdump + archive resolve + bulk-gap = backup!=1) + cadence
  scheduler (4th daemon goroutine, default 24h) + in-memory report store.
- hub: Backup/RestoreTest filled; collector seams; cross-repo golden byte-identical +
  bidirectional key-set tests; hub handler logs a FAILED restore-test prominently.
- config BackupConfig (band 990000-990009 default); --selftest=backup / restore-test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/report.go

@@ -165,10 +165,41 @@ const (
 	StorageStateDecommissioned = "decommissioned"
 )
 
-type Backup struct{} // slice 6: per-target backup status fields TBD
-type RestoreTest struct{}   // slice 6: self-restore-test result fields TBD
-type PBSSnapshot struct{}   // slice 6: PBS snapshot inventory fields TBD
-type AuditEntry struct{}    // audit-log tail entry fields TBD
+// Backup is the latest guest-vzdump result per target (doc 03 §8, slice 6 Phase A). An
+// agent-initiated vzdump is CRASH-CONSISTENT only (no fsfreeze; app-consistency needs the
+// controller quiesce, slice 8) — marked so here. UncoveredVolumes lists the guest's
+// backup=0 (or backup-unset) mountpoints excluded from the vzdump — the bulk-volume DR gap
+// (the bulk-backup mechanism is slice 10). Cross-repo contract: keep byte-identical with
+// felhom.eu/hub and the bidirectional golden key-set test.
+type Backup struct {
+	TargetID         string   `json:"target_id"`         // backup storage name (e.g. "local")
+	VMID             int      `json:"vmid"`              // source guest
+	Archive          string   `json:"archive"`           // produced vzdump volid
+	Mode             string   `json:"mode"`              // snapshot | stop
+	CrashConsistent  bool     `json:"crash_consistent"`  // always true this slice
+	SizeBytes        int64    `json:"size_bytes"`
+	Success          bool     `json:"success"`
+	Error            string   `json:"error,omitempty"`
+	StartedAt        string   `json:"started_at"`        // RFC3339
+	DurationSeconds  float64  `json:"duration_seconds"`
+	UncoveredVolumes []string `json:"uncovered_volumes"` // backup=0/unset mountpoints (bulk gap)
+}
+
+// RestoreTest is the latest self-restore-test result (doc 03 §8). This slice verifies
+// boot+running only (deep app-health is slice 8). SourceTier is "local" here; PBS is Phase B.
+type RestoreTest struct {
+	SourceArchive   string  `json:"source_archive"`
+	SourceTier      string  `json:"source_tier"` // "local" (pbs = Phase B)
+	ScratchVMID     int     `json:"scratch_vmid"`
+	Pass            bool    `json:"pass"`
+	Verified        string  `json:"verified"` // "boot+running" this slice
+	Error           string  `json:"error,omitempty"`
+	TestedAt        string  `json:"tested_at"` // RFC3339
+	DurationSeconds float64 `json:"duration_seconds"`
+}
+
+type PBSSnapshot struct{} // slice 6 Phase B: PBS snapshot inventory fields TBD
+type AuditEntry struct{}  // audit-log tail entry fields TBD
 
 // ControlEnvelope is the hub's 200 response to a host-report. This slice the agent
 // adopts ONLY PollIntervalSeconds; the rest are reserved/forward-compat fields it