v0.117.0: consuming-namespace NAS verification + deploy-view truth (RCA fixes 2+4)

statfs fsclass helper (network/autofs/stub/unknown, fail-open); probe not_network_fs
assertion (stub can never verify — red-proven); deploy-time stub refusal (idle autofs
proceeds — red-proven); distinct stub badge, stub wins over unreachable (unreachable line
byte-identical); deployed select shows stored HDD_PATH (red-proven vs IsDefault-only).
MinAgent unchanged 0.81.0. Gates green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/system/fsclass_linux.go

@@ -0,0 +1,19 @@
+//go:build linux
+
+package system
+
+import "syscall"
+
+// statfsFn is the syscall seam (tests inject fake f_types without real mounts).
+var statfsFn = syscall.Statfs
+
+// ClassifyPathFS classifies path by its filesystem magic in this process's mount namespace.
+// UNBOUNDED — statfs on a mounted-but-dead network fs can block for the soft-timeout window;
+// interactive callers use ClassifyPathFSTimeout. statfs error → FSClassUnknown.
+func ClassifyPathFS(path string) string {
+	var st syscall.Statfs_t
+	if err := statfsFn(path, &st); err != nil {
+		return FSClassUnknown
+	}
+	return classifyFSMagic(int64(st.Type))
+}