fill watch: one warning per filesystem (R-1371) — committed, not released

On a box whose guest has one data volume the two built-in fill targets, "/"
(the controller's overlay on the Docker data volume) and /mnt/sys_drive, are one
filesystem. The target list was de-duplicated by path only, so one fill would
send two warnings under two names.

fillTargets now keeps one target per filesystem; the first stays (app area,
system area, drives). The identity is system.FilesystemKey, not st_dev alone:
inside the container "/" is an overlay with its own device number, so an
overlay path takes the device of a Docker-kept file on the data-root
(/etc/hostname, /etc/hosts, /etc/resolv.conf). Measured read-only on demo-hp
9201/9202 and the N100 on 2026-11-10.

Tests: TestR1371_* (3), TestFilesystemKey_* (2). Red seen three times.
No version, no image, no floor: it waits for a release session.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/system/fskey_other.go

@@ -0,0 +1,8 @@
+//go:build !linux
+
+package system
+
+// Not Linux (dev/testing only): no filesystem identity, so nothing is ever de-duplicated.
+func statDev(_ string) (uint64, bool) { return 0, false }
+
+func isOverlayFS(_ string) (isOverlay, ok bool) { return false, false }