R-444: weekly guest disk trim (pct fstrim) outside the night, under the heavy-op gate

Operator ruling 09 §3 decision 139. One exact sudoers rule FELHOM_FSTRIM
(`/usr/sbin/pct ^fstrim [0-9]+$`) + manifest entry guest-fstrim; new
internal/fstrim job: due Wednesday from 10:00 host-local, starts only
10:00-20:59, holds backup.InFlight (busy -> deferred to the next hourly
tick), failed trim retried at most 3x per week, bytes parsed from the
"(N bytes) trimmed" lines, last result per guest persisted in
<state_dir>/guest-disk-trim.json and reported as guest_disk_trim.
Config opt-out: "disk_trim": {"disable": true}.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/hub/report.go

@@ -124,6 +124,11 @@ type HostReport struct {
 	// on HostReport would have been the only report block named against that convention.
 	GuestNet *GuestNetStatus `json:"guest_net,omitempty"`
 
+	// GuestDiskTrim is the weekly guest disk trim stanza (R-444, `09` §3 decision 139): the schedule and, per owned
+	// guest, the LAST trim result as persisted by the agent (it survives a restart). Present only when the trim job is
+	// wired; an empty `guests` list means the job runs and no guest has been trimmed yet. No secret.
+	GuestDiskTrim *GuestDiskTrimStatus `json:"guest_disk_trim,omitempty"`
+
 	// LogTail is the agent's on-demand debug-ring tail (v0.83.0 observability) — the agent
 	// mirror of the controller's report log_tails channel. Present ONLY on the heartbeat
 	// right after the control envelope requested it (log_tail_requested); consume-once on
@@ -208,6 +213,27 @@ type GuestNetGuest struct {
 	Message       string `json:"message,omitempty"`
 }
 
+// GuestDiskTrimStatus is the R-444 weekly trim stanza. `schedule` is a plain description of when the job runs (local
+// time of the host); `guests` holds one entry per owned guest that has had at least one trim attempt.
+type GuestDiskTrimStatus struct {
+	Schedule string          `json:"schedule"`
+	Guests   []GuestDiskTrim `json:"guests,omitempty"`
+}
+
+// GuestDiskTrim is one guest's LAST trim attempt. `ok` with `last_attempt_at` is the verdict of that attempt — never
+// read the time alone as success; `last_ok_at` is the last attempt that succeeded ("" = never). `bytes_trimmed` is
+// the sum of the "(N bytes) trimmed" lines `pct fstrim` printed, over `mounts` mount points.
+type GuestDiskTrim struct {
+	VMID            int     `json:"vmid"`
+	LastAttemptAt   string  `json:"last_attempt_at"`
+	OK              bool    `json:"ok"`
+	BytesTrimmed    int64   `json:"bytes_trimmed"`
+	Mounts          int     `json:"mounts"`
+	DurationSeconds float64 `json:"duration_seconds"`
+	LastOKAt        string  `json:"last_ok_at,omitempty"`
+	Error           string  `json:"error,omitempty"`
+}
+
 type PBSDRStatus struct {
 	State          string `json:"state"`
 	StorageID      string `json:"storage_id,omitempty"`