dr: recovered WG-key install + host_loss directive→restore-PLAN (S5 safe halves)

wgtunnel.InstallRecoveredKey: write an escrow-recovered WG private key (create-
only, refuse-overwrite) so the tunnel re-establishes with the same identity/pubkey
(same /32), no keygen. Wired into identity-consume -install-wg-key (opt-in;
pre-S3 blob → logged fresh-keygen fallback). Value never logged.

internal/dr (new): consume the host_loss restore_directive (was logged-ignored)
into an inspectable RestorePlan via the AddConsumer raw seam — per guest
{vmid,archive,target,sizing} + per drive {durable_id→mount} + offsite PBS coord.
DERIVE-AND-SURFACE only; the Consumer has no restore/destroy dependency (execute-
nothing is structural). guest_loss/absent → no plan.

Tests + red-proofs (WG create-only overwrite; plan mode-gate). No secrets on
argv/stdout/logs. The destructive in-place restore is a separate operator-present
STOP-gated drill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/wgtunnel/key.go

@@ -88,6 +88,35 @@ func KeyFilePath(stateDir string) string {
 	return filepath.Join(stateDir, "wg", keyFileName)
 }
 
+// InstallRecoveredKey writes an escrow-recovered WG private key (base64 of 32 bytes) to the key
+// file — the S5 host-loss DR step so the tunnel re-establishes with the SAME identity/pubkey (→ the
+// same hub `/32`), no fresh keygen. **CREATE-ONLY:** it REFUSES if a key file already exists (a
+// present key may be a live identity — the never-overwrite rule EnsureKey enforces too). The value
+// is validated (32-byte base64) and stored canonical (re-encoded), matching EnsureKey's on-disk
+// form; it is NEVER logged (caller logs the field NAME only). No-op guard: an empty privB64 is a
+// caller error (the bundle lacked a WG key → the fresh-keygen fallback path, not this one).
+func InstallRecoveredKey(stateDir, privB64 string) error {
+	priv, err := decodeKey([]byte(privB64))
+	if err != nil {
+		return fmt.Errorf("wgtunnel: recovered wg key is not 32-byte base64: %w", err)
+	}
+	dir := filepath.Join(stateDir, "wg")
+	path := filepath.Join(dir, keyFileName)
+	if _, serr := os.Stat(path); serr == nil {
+		return fmt.Errorf("wgtunnel: key file %s already exists — refusing to overwrite (a present key may be a live identity)", path)
+	} else if !os.IsNotExist(serr) {
+		return fmt.Errorf("wgtunnel: stat key file: %w", serr)
+	}
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return fmt.Errorf("wgtunnel: creating %s: %w", dir, err)
+	}
+	enc := base64.StdEncoding.EncodeToString(priv) + "\n"
+	if err := os.WriteFile(path, []byte(enc), 0o600); err != nil {
+		return fmt.Errorf("wgtunnel: writing recovered key file: %w", err)
+	}
+	return nil
+}
+
 // decodeKey parses a key-file payload: base64 of exactly 32 bytes (trailing whitespace ok).
 func decodeKey(raw []byte) ([]byte, error) {
 	s := string(raw)