v0.117.0: consuming-namespace NAS verification + deploy-view truth (RCA fixes 2+4)

statfs fsclass helper (network/autofs/stub/unknown, fail-open); probe not_network_fs
assertion (stub can never verify — red-proven); deploy-time stub refusal (idle autofs
proceeds — red-proven); distinct stub badge, stub wins over unreachable (unreachable line
byte-identical); deployed select shows stored HDD_PATH (red-proven vs IsDefault-only).
MinAgent unchanged 0.81.0. Gates green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/system/fsclass_test.go

@@ -0,0 +1,28 @@
+package system
+
+import "testing"
+
+// The classification table (RCA fix 2): network fs magics and the healthy idle autofs trigger are
+// OK; anything local is a STUB.
+func TestClassifyFSMagic_Table(t *testing.T) {
+	cifsU32 := uint32(0xFF534D42) // runtime value: the sign-extended form must classify identically
+	cases := []struct {
+		name  string
+		ftype int64
+		want  string
+	}{
+		{"autofs trigger (idle — healthy)", 0x0187, FSClassAutofs},
+		{"nfs (all versions)", 0x6969, FSClassNetwork},
+		{"cifs", 0xFF534D42, FSClassNetwork},
+		{"cifs as sign-extended negative", int64(int32(cifsU32)), FSClassNetwork},
+		{"smb2", 0xFE534D42, FSClassNetwork},
+		{"ext4 (the RCA stub)", 0xEF53, FSClassStub},
+		{"tmpfs", 0x01021994, FSClassStub},
+		{"overlayfs", 0x794C7630, FSClassStub},
+	}
+	for _, c := range cases {
+		if got := classifyFSMagic(c.ftype); got != c.want {
+			t.Errorf("%s: classifyFSMagic(%#x) = %q, want %q", c.name, c.ftype, got, c.want)
+		}
+	}
+}