R-25 (controller half): drive init mounts the filesystem UUID the agent verified

agentapi FormatResult / FormatStatusResult gain fs_uuid (agent R-25 half). runStorageInit mounts
it — from the synchronous answer or the polled status — instead of re-resolving the UUID from the
/dev path, so a node that moved between format and mount cannot redirect the mount. An agent that
sends no field keeps the old resolve, logged as a WARN each time (the window is open then).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/agentapi/client.go

@@ -395,6 +395,10 @@ type FormatResult struct {
 	DurableID         string `json:"durable_id,omitempty"`
 	// PendingOp is set on a SYSTEM/BACKUP data-bearing refusal — the operator-signature op.
 	PendingOp *PendingOp `json:"pending_op,omitempty"`
+	// FSUUID (R-25, agent >= the R-25 agent half) is the UUID of the filesystem the agent just made,
+	// sent only while the format's durable id still names the formatted device. "" = not verified, or
+	// an agent too old to send it. The init flow mounts THIS rather than re-resolving from the /dev path.
+	FSUUID string `json:"fs_uuid,omitempty"`
 }
 
 // PendingOp mirrors the agent's bound destructive intent on a data-bearing refusal. The controller
@@ -808,6 +812,8 @@ type FormatStatusResult struct {
 	Device string `json:"device"`
 	FSType string `json:"fstype"`
 	Error  string `json:"error"`
+	// FSUUID (R-25): see FormatResult.FSUUID — "" until the job is done and verified.
+	FSUUID string `json:"fs_uuid,omitempty"`
 }
 
 // FormatStatus fetches the agent's most-recent format-job record.