v0.58.0: infra-protection prevention layer for the OS/Docker-data split (Phase 2)

Reserved-buffer headroom guard on the Docker-data volume (system/dockervol.go,
max(5GB,10%)); deploy-time hard gate refuses (HTTP 507) when below the buffer
(api/router.go); deploy page warns + disables the button (deploy.html); runtime
disk monitor confirmed to watch the Docker volume above the buffer. Log rotation
baked into the golden (agent side). Phase 1 = felhom-agent v0.29.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,30 @@
 ## Changelog
 
+### v0.58.0 — infra-protection prevention layer for the OS/Docker-data split (2026-06-13)
+
+Phase 2 of the storage-split slice (Phase 1 = felhom-agent golden + provision). The OS rootfs and
+Docker data are split onto separate volumes for resilience; infra (controller/traefik/cloudflared/
+filebrowser) shares the one Docker data-root and is protected by **prevention, not placement**.
+
+- **Reserved-buffer headroom guard (`internal/system/dockervol.go`):** `GetDockerVolumeHeadroom()`
+  measures the Docker-data volume via `statfs("/")` (the controller container's root overlay is backed
+  by the guest's `/var/lib/docker` volume) and computes a reserved floor `DockerVolumeReserveGB` =
+  `max(5 GB, 10% of total)`. Fail-open on a measurement error (the buffer is a safety net, not a
+  security control).
+- **Deploy-time hard gate (`internal/api/router.go` `deployStack`):** a new deploy is **refused** (HTTP
+  507 + Hungarian message) when free space on the Docker-data volume is at/under the reserved buffer,
+  so customer apps can't fill the volume the infra containers depend on.
+- **Deploy-page surfacing (`deploy.html`):** for a new deploy, when below the buffer the page shows a
+  clear Hungarian warning and **disables** the "Telepítés indítása" button (mirrors the memory-blocked
+  pattern) — the customer sees it before clicking; the API gate is the hard backstop.
+- **Runtime monitoring (2C):** confirmed `monitor/healthcheck.go` already watches `sysInfo.DiskPercent`
+  = the Docker-data volume post-split (statfs `/`); warn 80% / crit 90% used trip ABOVE the 10%-free
+  reserved buffer, so the customer is warned before the deploy gate engages. Comment added to make the
+  "SSD disk" alert's target explicit.
+- **Log rotation (2D):** baked into the golden's `daemon.json` (`max-size 10m`, `max-file 3`) in the
+  felhom-agent golden build — every guest inherits it. Per-app xfs-project-quota caps deferred.
+- Tests: `DockerVolumeReserveGB` floor/scale.
+
 ### v0.57.0 — UI fixes: stable host-storage list + per-app Tier-2 config panel (2026-06-13)
 
 Part A of the UI-fixes/storage-spike spec (Part B is a build-nothing findings report).