agent (unreleased): fixes after an independent review — one lock for the writers of agent.json, the trust run serialised and bounded, the CA copy keeps its previous root, the profile stanza from the wrapper's answer, a stale give-up ends, both boot tokens from one read

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/guestpower_test.go

@@ -281,3 +281,38 @@ func TestGuestPower_GiveUpIsReportedUntilTheGuestRuns(t *testing.T) {
 		t.Fatalf("the guest runs again and the stanza is still %#v", st)
 	}
 }
+
+// Found by review, 2026-11-14: the give-up was forgotten only when the guest was seen RUNNING. A guest the operator
+// then switches to onboot:0, a guest another operation locks, and a guest that is destroyed would be reported as
+// „given up” for ever (the hub's alarm could never clear). Each of the three ends the report.
+func TestGuestPower_GiveUpEndsWhenTheGuestIsNoLongerOurs(t *testing.T) {
+	for _, c := range []struct {
+		name   string
+		change func(ctl *fakeGuestPowerCtl)
+	}{
+		{"onboot switched off", func(ctl *fakeGuestPowerCtl) { ctl.onboot = map[int]bool{9201: false} }},
+		{"locked by another operation", func(ctl *fakeGuestPowerCtl) { ctl.locks = map[int]string{9201: "backup"} }},
+		{"destroyed", func(ctl *fakeGuestPowerCtl) { ctl.guests = nil }},
+	} {
+		ctl := &fakeGuestPowerCtl{
+			guests:   []proxmox.Guest{{VMID: 9201, Status: "stopped"}},
+			locks:    map[int]string{9201: ""},
+			onboot:   map[int]bool{9201: true},
+			startErr: errors.New("cannot start"),
+		}
+		now := time.Date(2026, 11, 14, 2, 0, 0, 0, time.UTC)
+		s := gpServer(t, ctl, func() time.Time { return now })
+		for i := 0; i < guestPowerMaxAttempts+1; i++ {
+			s.GuestPowerTick(context.Background())
+			now = now.Add(10 * time.Minute)
+		}
+		if len(s.GuestPowerGaveUp()) != 1 {
+			t.Fatalf("%s: setup — no give-up recorded", c.name)
+		}
+		c.change(ctl)
+		s.GuestPowerTick(context.Background())
+		if g := s.GuestPowerGaveUp(); len(g) != 0 {
+			t.Errorf("%s: the give-up is still reported: %+v", c.name, g)
+		}
+	}
+}