docs(tests): Campaign 2 report + evidence — DR primitives, self-update, storage, faults, endurance

Full-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:
ONE genuine pilot-critical finding — the non-root agent cannot pct-restore the
standard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,
mp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH
--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing
VM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated
by one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/
dryrun-journal/escrow-blob calibration issues; the product where actually exercised was
healthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state
(auth off, notifications restored, no scratch leaks). No production code changed.

Evidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/tests/campaign2-evidence-2026-07-07/evidence/T-P10-ENDSTATE/containers.txt

@@ -0,0 +1,22 @@
+sparkyfitness-server Up 5 seconds (health: starting)
+sparkyfitness-db Up 11 seconds (healthy)
+rallly Up 12 seconds (healthy)
+rallly-postgres Up 18 seconds (healthy)
+paperless-webserver Up 19 seconds (health: starting)
+paperless-postgres Up 29 seconds (healthy)
+paperless-redis Up 29 seconds (healthy)
+nextcloud Up 30 seconds (healthy)
+nextcloud-db Up 36 seconds (healthy)
+nextcloud-redis Up 36 seconds (healthy)
+navidrome Up 36 seconds (healthy)
+mealie Up 37 seconds (healthy)
+gitea Up 38 seconds (healthy)
+calcom Up 38 seconds (health: starting)
+calcom-postgres Up 44 seconds (healthy)
+bookstack Up 44 seconds (health: starting)
+bookstack-db Up 50 seconds (healthy)
+actualbudget Up 50 seconds (healthy)
+filebrowser Up 6 minutes (healthy)
+felhom-controller Up 6 minutes (healthy)
+cloudflared Up 6 minutes
+traefik Up 6 minutes

documentation/tests/campaign2-evidence-2026-07-07/evidence/T-P10-ENDSTATE/lsblk.txt

@@ -0,0 +1,28 @@
+NAME                            SIZE TYPE TRAN   MOUNTPOINTS
+sda                           476.9G disk sata   
+├─sda1                         1007K part        
+├─sda2                            1G part        /boot/efi
+└─sda3                        475.9G part        
+  ├─pve-swap                      8G lvm         [SWAP]
+  ├─pve-root                     96G lvm         /mnt/felhom-drives
+  │                                              /
+  ├─pve-data_tmeta              3.6G lvm         
+  │ └─pve-data-tpool          348.8G lvm         
+  │   ├─pve-data              348.8G lvm         
+  │   ├─pve-vm--9201--disk--0    32G lvm         
+  │   ├─pve-vm--9201--disk--1   200G lvm         
+  │   └─pve-vm--9201--disk--2    50G lvm         
+  └─pve-data_tdata            348.8G lvm         
+    └─pve-data-tpool          348.8G lvm         
+      ├─pve-data              348.8G lvm         
+      ├─pve-vm--9201--disk--0    32G lvm         
+      ├─pve-vm--9201--disk--1   200G lvm         
+      └─pve-vm--9201--disk--2    50G lvm         
+sdb                            59.5G disk usb    /mnt/felhom-drives/teszt_enroll
+                                                 /mnt/teszt_enroll
+sdc                           119.5G disk usb    
+└─sdc1                        119.5G part        /mnt/felhom-drives/felhom-flash
+                                                 /mnt/felhom-flash
+sdd                           931.5G disk usb    
+└─sdd1                        931.5G part        /mnt/felhom-drives/felhom-usb
+                                                 /mnt/felhom-usb

documentation/tests/campaign2-evidence-2026-07-07/evidence/T-P10-ENDSTATE/stacks.json

@@ -0,0 +1 @@
+{"ok":false,"error":"authentication required"}