docs(offsite): S4.1 — restore-test unattended (tier-aware deadline; VM.Allocate phantom)

Offsite restore-test now runs unattended on the agent-token path (agent v0.68.0):
tier-aware restore-task timeout (pbs→120m, local→10m). The scratch-band
VM.Allocate follow-up was a phantom — the scratch restores INTO /pool/felhom
(ACL already grants it); the earlier 403 was the 10m-timeout consequence. No
ACL/host-install change. doc-06 S4 row + runbook §4b updated.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/runbooks/offsite-endpoint.md

@@ -223,10 +223,12 @@ returns `verify=ok`; the WARN is gone; a restore reads it back decrypting with t
 
 **Provisioning notes / follow-ups (S4):** (a) the `.pw` copy in `pbs-secrets` is a STATIC snapshot
 of the PVE token secret — a token rotation must re-copy it (a sync step for the hub-driven-tenancy
-slice). (b) The restore-test scheduler's internal restore-task deadline (~10 min) is too short for
-a WAN restore of a large volume, and the agent PVE token lacks `VM.Allocate` on the scratch VMID
-band for teardown — both are box-side config fixes needed before the offsite restore-test can run
-unattended (raise the restore deadline for the `pbs` tier; grant the scratch-band VM.Allocate).
+slice). (b) The offsite restore-test now runs **unattended** (S4.1, agent v0.68.0): the restore-task
+wait is tier-aware (`restore_test_pbs_restore_timeout_seconds`, default 120m for the `pbs` tier;
+local stays 10m). The earlier "grant scratch-band `VM.Allocate`" idea was a **phantom** — the scratch
+is restored INTO `/pool/felhom` (whose ACL already grants `VM.Allocate`), so teardown is authorized
+once the restore completes; the earlier 403 was the 10m-timeout firing teardown against a
+not-yet-pooled guest. Live-proven on the agent-token path: `pass:true`, teardown clean, band empty.
 
 ## 5. Peersync surface