v0.58.0: infra-protection prevention layer for the OS/Docker-data split (Phase 2)

Reserved-buffer headroom guard on the Docker-data volume (system/dockervol.go,
max(5GB,10%)); deploy-time hard gate refuses (HTTP 507) when below the buffer
(api/router.go); deploy page warns + disables the button (deploy.html); runtime
disk monitor confirmed to watch the Docker volume above the buffer. Log rotation
baked into the golden (agent side). Phase 1 = felhom-agent v0.29.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/system/dockervol_test.go

@@ -0,0 +1,24 @@
+package system
+
+import "testing"
+
+// DockerVolumeReserveGB = max(5 GB, 10% of total): a flat 5 GB floor for small volumes, scaling to
+// 10% on larger ones (so a 256 GB data volume reserves ~25.6 GB, not the Tier-2 guard's 20%).
+func TestDockerVolumeReserveGB(t *testing.T) {
+	cases := []struct {
+		name    string
+		totalGB float64
+		want    float64
+	}{
+		{"tiny volume uses the 5G floor", 16, 5},
+		{"50G volume: 10% = 5G ties the floor", 50, 5},
+		{"100G volume: 10% dominates", 100, 10},
+		{"256G data volume", 256, 25.6},
+		{"zero total still floors at 5G", 0, 5},
+	}
+	for _, c := range cases {
+		if got := DockerVolumeReserveGB(c.totalGB); got != c.want {
+			t.Errorf("%s: DockerVolumeReserveGB(%.0f) = %.2f, want %.2f", c.name, c.totalGB, got, c.want)
+		}
+	}
+}