docs(tests): Campaign 2 report + evidence — DR primitives, self-update, storage, faults, endurance

Full-system validation on demo 9201 (controller v0.102.0 / agent v0.73.0). Headline:
ONE genuine pilot-critical finding — the non-root agent cannot pct-restore the
standard Felhom guest because it has bind-mount mountpoints (mp8 /mnt/felhom-drives,
mp9 bootstrap) and pct restore refuses bind mounts unless root. This breaks BOTH
--selftest=restore-test AND the offsite DR bring-up (R1), linked to a missing
VM.Audit/VM.Allocate on the agent token (R2). The large raw FAIL count is dominated
by one harness bug (auth-session expiry mis-scoring P3-P9) plus D1-injection/soak-probe/
dryrun-journal/escrow-blob calibration issues; the product where actually exercised was
healthy with ZERO resource leaks over ~7h. Demo node healed to pre-campaign state
(auth off, notifications restored, no scratch leaks). No production code changed.

Evidence snapshot + README under campaign2-evidence-2026-07-07/ (cookie jars scrubbed).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

documentation/tests/campaign2-evidence-2026-07-07/evidence/T-PAGE-ALL/pages.tsv

@@ -0,0 +1,13 @@
+/	200	Áttekintés	no
+/stacks	200	Alkalmazások	yes
+/backups	200	Mentés	yes
+/monitoring	200	Monitor	no
+/storage	200	Tárhely	yes
+/storage/network	200	Hálózati	yes
+/settings	200	Beállítások	yes
+/settings/notifications	200	Értesítés	yes
+/settings/security	200	Biztonság	yes
+/import	200	Import	yes
+/debug	404	Debug	no
+/apps/vaultwarden	200	Vaultwarden	yes
+/apps/paperless-ngx	200	Paperless	yes