v0.117.0: consuming-namespace NAS verification + deploy-view truth (RCA fixes 2+4)

statfs fsclass helper (network/autofs/stub/unknown, fail-open); probe not_network_fs
assertion (stub can never verify — red-proven); deploy-time stub refusal (idle autofs
proceeds — red-proven); distinct stub badge, stub wins over unreachable (unreachable line
byte-identical); deployed select shows stored HDD_PATH (red-proven vs IsDefault-only).
MinAgent unchanged 0.81.0. Gates green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/system/fsclass_linux_test.go

@@ -0,0 +1,36 @@
+//go:build linux
+
+package system
+
+import (
+	"syscall"
+	"testing"
+)
+
+// The statfs seam wires f_type into the classifier; a statfs error yields UNKNOWN (fail open), not
+// a stub verdict.
+func TestClassifyPathFS_Seam(t *testing.T) {
+	orig := statfsFn
+	t.Cleanup(func() { statfsFn = orig })
+
+	statfsFn = func(_ string, st *syscall.Statfs_t) error { st.Type = 0x6969; return nil }
+	if got := ClassifyPathFS("/anything"); got != FSClassNetwork {
+		t.Errorf("nfs magic → %q, want network", got)
+	}
+	statfsFn = func(_ string, st *syscall.Statfs_t) error { st.Type = 0x0187; return nil }
+	if got := ClassifyPathFS("/anything"); got != FSClassAutofs {
+		t.Errorf("autofs magic → %q, want autofs", got)
+	}
+	statfsFn = func(_ string, _ *syscall.Statfs_t) error { return syscall.EIO }
+	if got := ClassifyPathFS("/anything"); got != FSClassUnknown {
+		t.Errorf("statfs error → %q, want unknown (fail open, never stub)", got)
+	}
+}
+
+// Real-IO: a plain local directory MUST classify as a stub — this is the exact state the RCA's
+// guest reboot produced, and the verdict everything downstream keys on.
+func TestClassifyPathFS_RealLocalDirIsStub(t *testing.T) {
+	if got := ClassifyPathFS(t.TempDir()); got != FSClassStub {
+		t.Fatalf("a plain local dir must classify as stub, got %q", got)
+	}
+}