agent v0.26.0: slice 10 P2 activation — POST /guest/reboot (user-triggered)

Self-scoped guest reboot (pct reboot, detached, 202) so an enrolled-into-running-
guest drive's persisted bind activates at next boot. Tests: accepted + cross-guest
403. Pairs with controller v0.49.0 pending-drive detection + "Újraindítás most".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/localapi/guestbind.go

@@ -70,6 +70,19 @@ func (b *GuestBinder) AttachBind(ctx context.Context, vmid int, mountKey, where
 	return nil
 }
 
+// RebootGuest reboots the guest (graceful shutdown + start) so persisted-but-inactive mountpoint
+// binds activate (slice 10 P2: the host-side live inject is blocked on an unprivileged guest, so a
+// drive enrolled into a RUNNING guest activates only at the next boot — this is the user-triggered
+// "Újraindítás most" path). `pct reboot` blocks until the guest is back, so callers run it detached.
+func (b *GuestBinder) RebootGuest(ctx context.Context, vmid int) error {
+	b.logger.Warn("guest-reboot: rebooting guest to activate pending mountpoint binds", "vmid", vmid)
+	if err := b.run(ctx, "pct", "reboot", strconv.Itoa(vmid)); err != nil {
+		return fmt.Errorf("guest-reboot: pct reboot %d: %w", vmid, err)
+	}
+	b.logger.Info("guest-reboot: guest back up", "vmid", vmid)
+	return nil
+}
+
 func (b *GuestBinder) run(ctx context.Context, name string, args ...string) error {
 	_, stderr, err := b.runner.Run(ctx, name, args...)
 	if err != nil {