seam sweep: move the TieredBackend witness into production code (no version bump)

A witness in a _test.go file fires on go test and go vet but NOT on go build
alone — and a build-only step is exactly how the R-88 Part 2 near-miss would have
shipped. Moved beside the type it pins, and added one for AgentVersionReporter.

No defect found: quiesceBackend and *Client both satisfy their interfaces today.
No version bump, no deploy — compile-time only.

controller/cmd/controller/seam_witnesses.go

@@ -0,0 +1,22 @@
+package main
+
+import "gitea.dooplex.hu/admin/felhom-controller/internal/quiesce"
+
+// COMPILE-TIME WITNESSES for OPTIONAL interfaces satisfied by a RUNTIME type assertion.
+//
+// Moved here from a _test.go file (R-88 Part 2) on purpose: a witness in a test fires on `go test`
+// and `go vet`, but NOT on `go build` alone. The failure it guards against — a signature change that
+// silently breaks an interface nobody checks at compile time — is exactly the kind that gets pushed
+// by a build-only step.
+//
+// THE INCIDENT THIS PREVENTS, which already happened once: when `TieredBackend.DueFor` gained a
+// return value during R-88 Part 2, `quiesceBackend` stopped satisfying the interface and the whole
+// repo still BUILT AND VETTED CLEAN, because `resolveDueTiers` only ever asserts it at runtime
+// (`l.backend.(TieredBackend)`). A failed assertion silently falls back to the untargeted
+// single-tier path — so every box would have quietly lost R-82's multi-tier backups, with no error
+// anywhere. It was caught by accident, not by the toolchain.
+//
+// THIS DOES NOT MAKE THE INTERFACE REQUIRED. Optionality is deliberate: it is what lets a new
+// controller meet an old agent, and what `resolveDueTiers` degrades through on purpose. The witness
+// pins the IMPLEMENTATION, not the CONTRACT.
+var _ quiesce.TieredBackend = quiesceBackend{}