docs: v0.74.0 REPORT/CONTEXT/README — agent connection-leak fix + live proof

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/README.md

@@ -717,6 +717,12 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
 >   `EjectDisk`/`FormatDisk(…, confirmed, durableID)`; `DiskInfo.role`+capacity;
 >   `FormatResult.{role,needs_confirmation,durable_id}`; `ErrNeedsConfirmation` (user-data) vs
 >   `ErrFormatRefused` (system/backup). `FormatResult.PendingOp.OpsignCommand()` for the operator path.
+>   - **(v0.74.0) Client lifecycle — ONE shared client, reused.** `Server.agentClient()` builds the
+>     `agentapi.Client` once (memoized via `sync.Once`) and returns the same instance to all ~19 call
+>     sites; the `http.Transport` is bounded + expiring (`MaxIdleConnsPerHost:2`, `IdleConnTimeout:90s`).
+>     This replaced a per-call `agentapi.New(...)` that leaked one idle ESTABLISHED socket per call and
+>     exhausted the ephemeral source-port range to the agent's `:8443` after ~5 days (EADDRNOTAVAIL).
+>     Safe because `cfg.LocalAPI` is static per process (a config-apply triggers a graceful self-restart).
 > - The **`StoragePath` registry** (`settings.go`: `AddStoragePath`/default/schedulable/label) is unchanged.
 >   - **(v0.64.0) `AutoDiscoverStoragePaths` is now ADDITIVE** — it no longer bails when the registry is
 >     non-empty; instead it registers only deployed-app paths missing from the registry. It never removes