controller v0.48.0: slice 10 P2C — enroll passes the drive into the guest

agentapi GuestAttach(where) → POST /disks/guest-attach; runStorageInit/Attach +
handleStorageRegister call attachIntoGuest after register (best-effort, P3 heals).
Closes Branch A: enrolled drives become usable in the guest, banner clears.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/agentapi/client.go

@@ -323,6 +323,14 @@ func (c *Client) AssignDisk(ctx context.Context, uuid, where, fstype, options st
 	return err
 }
 
+// GuestAttach binds an enrolled drive's felhom-data namespace into THIS guest (slice 10 P2, Model A).
+// The drive must already be host-mounted at `where` (the enroll flow's assign did that). Idempotent on
+// the agent side (returns the existing slot if already bound). Returns nil on success.
+func (c *Client) GuestAttach(ctx context.Context, where string) error {
+	_, err := c.post(ctx, "/disks/guest-attach", map[string]string{"where": where})
+	return err
+}
+
 // EjectResult mirrors POST /disks/eject (the dependent-guest warning).
 type EjectResult struct {
 	VMID            int    `json:"vmid"`