v0.116.0: observability pass — always-on debug ring + leveled sweep + agent tab + self-log pull — MinAgent: 0.81.0

Capture layer: LogBuffer always exists; logger = MultiWriter(LevelFilterWriter
(stdout, logging.level), ring) so DEBUG detail exists remotely without a config
flip while docker logs keep respecting the level. New internal/logx leveled
helpers. Report ACK gains controller_log_requested (additive); next report
ships controller_log_tail (128KB, consume-once, app-tail wire byte-compatible).
Debug page: Vezérlő|Ügynök tabs; agent tab proxies agent /debug/logs with the
pre-0.83 notice on typed 404. Sweep: netstorage_job phases, netprobe, handler
validation refusals + orphan WARN, SupportsWithSource gate line, agentapi
per-call DEBUG, migrate phase lines, tier2/offbox unswallowed persists.
Red-proofs: filter-disabled, drain-removed, dropped-phase-line all FAIL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/stacks/migrate.go

@@ -361,7 +361,10 @@ func (m *Manager) migSourceSize(j *MigrationJob) int64 {
 // idempotent and skips already-completed units, so re-entry never re-copies or re-removes.
 func (m *Manager) runMigration(ctx context.Context, j *MigrationJob) {
 	defer m.releaseMigrating()
+	m.logger.Printf("[INFO] [migrate] %s running: %s → %s scope=%s apps=%d phase=%s",
+		j.ID, j.Source, j.Target, j.Scope, len(j.Apps), j.Phase)
 	for {
+		m.logger.Printf("[DEBUG] [migrate] %s phase %s", j.ID, j.Phase)
 		var err error
 		switch j.Phase {
 		case PhaseStop:
@@ -404,7 +407,8 @@ func (m *Manager) runMigration(ctx context.Context, j *MigrationJob) {
 			m.logger.Printf("[ERROR] [migrate] journal write failed: %v", perr)
 		}
 		if j.Phase == PhaseDone {
-			m.logger.Printf("[INFO] [migrate] %s complete: %s → %s (%d app(s))", j.ID, j.Source, j.Target, len(j.Apps))
+			m.logger.Printf("[INFO] [migrate] %s complete: %s → %s (%d app(s), %s)",
+				j.ID, j.Source, j.Target, len(j.Apps), j.FinishedAt.Sub(j.StartedAt).Round(time.Second))
 			if m.migDoneHook != nil {
 				m.migDoneHook(j.clone()) // decommission policy (soft-mark + agent) lives in the hook
 			}