v0.58.0: infra-protection prevention layer for the OS/Docker-data split (Phase 2)

Reserved-buffer headroom guard on the Docker-data volume (system/dockervol.go,
max(5GB,10%)); deploy-time hard gate refuses (HTTP 507) when below the buffer
(api/router.go); deploy page warns + disables the button (deploy.html); runtime
disk monitor confirmed to watch the Docker volume above the buffer. Log rotation
baked into the golden (agent side). Phase 1 = felhom-agent v0.29.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/monitor/healthcheck.go

@@ -44,7 +44,12 @@ func RunHealthCheck(cfg *config.Config, cpuCollector *system.CPUCollector, stora
 			sysInfo.CPUPercent, sysInfo.TemperatureCelsius, sysInfo.TemperatureSource)
 	}
 
-	// 1. Disk usage (SSD)
+	// 1. Disk usage (SSD). NOTE (storage-split): sysInfo.DiskPercent statfs's the controller
+	// container's "/", whose overlay upperdir lives on the guest's /var/lib/docker volume — so this
+	// IS the Docker-data volume guard (post-split it's the dedicated data volume; pre-split it's the
+	// rootfs — either way it's wherever Docker's data-root lives). Warn at 80% / crit at 90% used
+	// trips ABOVE the prevention layer's 10%-free reserved buffer, so the customer is warned before
+	// the deploy gate even engages.
 	if sysInfo.DiskPercent > 0 {
 		if sysInfo.DiskPercent >= float64(cfg.Monitoring.Thresholds.DiskCritPercent) {
 			report.Issues = append(report.Issues, fmt.Sprintf("SSD disk usage critical: %.0f%%", sysInfo.DiskPercent))