controller v0.178.0 — R-88 Part 2: only a positive 'never' fires the valve

MinAgent: 0.105.0. scheduledRunAllowed fired on any nil age; it now requires a
licence from valveLicensed, which grants it for AgeStateAbsent and for a LEGACY
agent, and refuses it for AgeStateUnknown. An unreadable storage no longer
masquerades as a first-ever backup and no longer quiesces apps outside the window.

A missing wire field means legacy, not unknown — deliberately. Treating it as
unknown would stop the valve firing on un-upgraded boxes and starve genuinely new
ones. Degrade logged once; unrecognised future values also map to legacy.

Caught in passing: TieredBackend is satisfied by a RUNTIME assertion, so the
signature change compiled and vetted clean while quiesceBackend silently stopped
satisfying it — which would have degraded every box to the single-tier path with
no error. Added a compile-time witness.

Also corrects the notifier comment that claimed operator-only came from a missing
customerMessages entry; enforcement is hub-side operatorOnlyEvents (hub 0.79.0).

controller/internal/agentapi/client.go

@@ -174,6 +174,14 @@ type DueResponse struct {
 	Due     bool   `json:"due"`
 	Reason  string `json:"reason"`
 	AgeSecs *int64 `json:"age_seconds"`
+	// AgeState (R-88 Part 2, agent >= v0.105.0) says WHY AgeSecs is nil: "absent" (a positive
+	// determination that no backup has ever landed) or "unknown" (the agent could not tell —
+	// unreadable storage, unparseable timestamp). "known" accompanies a real age.
+	//
+	// EMPTY MEANS LEGACY — an agent older than v0.105.0 simply omits the field. It does NOT mean
+	// "unknown", and the distinction is load-bearing: see quiesce.ageStateFromWire. Never
+	// discriminate on Reason instead; those strings are operator copy and will drift.
+	AgeState string `json:"age_state"`
 }
 
 // BackupResponse mirrors the agent's POST /backup payload.