v0.60.0: proof-of-launch destroy gating (F1a/b/c) + restore-test band-advance (F2)

Campaign pool-effects F1 (HIGH): the bring-up compensating rollback and the
restore-test teardown destroyed the target vmid even when RestoreLXC failed
synchronously without creating anything — destroying a guest the transaction
never made (only the pool ACL 403 contained it). A RestoreLXC UPID is now the
sole destroy authorization in all three destroy paths (in-process bring-up
defer, in-process restore-test teardown, Recover). F2: the restore-test
advances past an 'already exists' band vmid (invisible squatter) instead of
failing + false-alerting; a fully-occupied band Skips.

Red-proof verified: with the gates reverted, the four new tests fail with the
innocent-guest destroy. go build/vet/test clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/reconcile/engine_test.go

@@ -36,6 +36,9 @@ type fakeAPI struct {
 	// restoreHook, when set, fires inside RestoreLXC (used to assert the owning journal entry
 	// is written BEFORE the restore — crash-safety ordering).
 	restoreHook func()
+	// restoreFunc, when set, backs RestoreLXC per-call (drives the F2 band-advance tests:
+	// per-vmid "already exists" vs success). Takes precedence over restoreUPID/restoreErr.
+	restoreFunc func(opts proxmox.RestoreLXCOptions) (string, error)
 
 	starts   []int
 	stops    []int
@@ -58,7 +61,11 @@ func (f *fakeAPI) RestoreLXC(_ context.Context, opts proxmox.RestoreLXCOptions)
 	}
 	f.mu.Lock()
 	f.restores = append(f.restores, opts)
+	fn := f.restoreFunc
 	f.mu.Unlock()
+	if fn != nil {
+		return fn(opts)
+	}
 	return f.restoreUPID, f.restoreErr
 }