controller v0.67.0: intermediary-mount — HDD_PATH repoint + drive-absent gate + H1 routes

Drives are visible in-guest only at the STABLE /mnt/felhom-drives/<name>; the
registered path + HDD_PATH + FileBrowser source repoint there while agent calls
map back to raw /mnt/<name> (agentWhere). Enroll binds-under-parent before
register. Drive-absent GATE (planDriveGates + 30s driveGateLoop) stops/blocks
apps when a drive vanishes and auto-restarts on return; start-gate refuses start
when the drive is absent. H1 endpoints (disconnect/reconnect/restart-apps) routed
onto host-side ops. Non-hollow tests + companions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/agentapi/client.go

@@ -251,8 +251,15 @@ type DiskInfo struct {
 	WipeDurableID string `json:"wipe_durable_id,omitempty"`
 	// GuestAttached reports whether the drive is actually bound into THIS guest (usable in-guest), as
 	// opposed to merely present on the host (F9) — the signal whose absence let the HDD look available
-	// when it wasn't attached.
+	// when it wasn't attached. LEGACY (per-drive mp model); the intermediary model uses BoundUnderParent.
 	GuestAttached bool `json:"guest_attached"`
+	// GuestPath is the drive's STABLE in-guest path in the intermediary-mount model
+	// (/mnt/felhom-drives/<name>) — what the controller registers + repoints HDD_PATH to. Distinct from
+	// MountPath (the raw /mnt/<name> host PVE mount the agent ops on). "" for non-user-data drives.
+	GuestPath string `json:"guest_path,omitempty"`
+	// BoundUnderParent reports whether the drive's felhom-data is currently bound under the shared parent
+	// (live + usable in the guest). The controller's drive-absent gate keys on this + State.
+	BoundUnderParent bool `json:"bound_under_parent"`
 }
 
 // FSUUID returns the raw filesystem UUID from a "uuid:<…>" DurableID, or "" if this disk's identity