slice 8A (controller half): bootstrap.json ingestion + pinned agent local-API client (v0.35.0)

internal/bootstrap: first-run bootstrap.json ingestion (decision (c)) — seed
controller.yaml + skip setup; idempotent + fail-safe. internal/agentapi:
minimal pinned local-API client (leaf-cert SHA-256 pin, fails closed). config
LocalAPIConfig; startup /storage connectivity probe.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

controller/internal/config/config.go

@@ -28,6 +28,16 @@ type Config struct {
 	Logging        LoggingConfig        `yaml:"logging"`
 	Assets         AssetsConfig         `yaml:"assets"`
 	System         SystemConfig         `yaml:"system"`
+	LocalAPI       LocalAPIConfig       `yaml:"local_api"`
+}
+
+// LocalAPIConfig is the in-guest controller's handle on the host agent's per-guest local API
+// (doc 03 §6, slice 8A). The agent mints the token + serves a self-signed leaf; the controller
+// reaches it over the bridge, pinning the leaf SHA-256. Seeded from bootstrap.json at first run.
+type LocalAPIConfig struct {
+	Endpoint    string `yaml:"endpoint"`    // host bridge IP:port, e.g. "192.168.0.162:8443"
+	Fingerprint string `yaml:"fingerprint"` // agent leaf-cert SHA-256 (hex) to pin
+	Token       string `yaml:"token"`       // per-guest bearer; SECRET
 }
 
 type SystemConfig struct {