agent (unreleased): fixes after an independent review — one lock for the writers of agent.json, the trust run serialised and bounded, the CA copy keeps its previous root, the profile stanza from the wrapper's answer, a stale give-up ends, both boot tokens from one read

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/disks.go

@@ -90,6 +90,8 @@ type GuestAttacher interface {
 	// GuestBootKey is the same signal built from the kernel's boot_id, which a step of the host's clock cannot
 	// move (R-1395). "" = not readable; the controller then reads GuestBootID.
 	GuestBootKey(ctx context.Context, vmid int) string
+	// GuestBootTokens returns (GuestBootID, GuestBootKey) from one read — what /disks sends.
+	GuestBootTokens(ctx context.Context, vmid int) (id, key string)
 	// AttachBind is the LEGACY per-drive `pct set -mpN` bind (pre-intermediary). Retained for the
 	// transition; new attaches use AttachDrive.
 	AttachBind(ctx context.Context, vmid int, mountKey, where string) error
@@ -437,8 +439,7 @@ func (s *Server) handleDisks(w http.ResponseWriter, r *http.Request, vmid int) {
 	// R-1395: guest_boot_key is the clock-proof form (kernel boot_id); guest_boot_id stays for older controllers.
 	bootID, bootKey := "", ""
 	if s.guestAttach != nil {
-		bootID = s.guestAttach.GuestBootID(r.Context(), vmid)
-		bootKey = s.guestAttach.GuestBootKey(r.Context(), vmid)
+		bootID, bootKey = s.guestAttach.GuestBootTokens(r.Context(), vmid)
 	}
 	writeOK(w, map[string]any{"vmid": vmid, "disks": out, "guest_boot_id": bootID, "guest_boot_key": bootKey})
 }