controller (unreleased): a step of the host's clock is not a new boot (R-1395)

The boot pass decides through guestBootVerdict and prefers the agent's new guest_boot_key (kernel boot_id), which a
clock step cannot move. An agent that sends no key gets the old rule. The move to the key recreates nothing.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/agentapi/client.go

@@ -392,6 +392,10 @@ type DisksResponse struct {
 	// GuestBootID changes on every guest boot (host or guest reboot) but is stable across a
 	// controller-only restart — the deterministic signal the controller recreates drive-backed apps on.
 	GuestBootID string `json:"guest_boot_id,omitempty"`
+	// GuestBootKey (R-1395; an agent after 0.174.0) is the same signal built from the kernel's boot_id instead of
+	// the boot TIME: a step of the host's clock moves the boot time (and so GuestBootID) and does not move this.
+	// "" from an older agent — the controller then reads GuestBootID as before. See web.guestBootVerdict.
+	GuestBootKey string `json:"guest_boot_key,omitempty"`
 }
 
 // FormatResult mirrors POST /disks/format (the success/refusal payload).