controller v0.68.0: storage lifecycle on intermediary model (H2/H3/M1/M3 + boot-id)

H2 decommission UI button (migrate / anyway); H3 one-click re-enroll of a
decommissioned drive; M1 default reassignment (auto-promote + block-if-none);
M3 migrate re-asserts 2775 setgid on userdata dirs; deterministic guest-reboot
recreate via agent boot_id (replaces the timed sample). Fixes the {path}/{where}
H1 JS bug. Non-hollow tests + companions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/agentapi/client.go

@@ -275,6 +275,9 @@ func (d DiskInfo) FSUUID() string {
 type DisksResponse struct {
 	VMID  int        `json:"vmid"`
 	Disks []DiskInfo `json:"disks"`
+	// GuestBootID changes on every guest boot (host or guest reboot) but is stable across a
+	// controller-only restart — the deterministic signal the controller recreates drive-backed apps on.
+	GuestBootID string `json:"guest_boot_id,omitempty"`
 }
 
 // FormatResult mirrors POST /disks/format (the success/refusal payload).