feat(update): pre-flight gates + deeper healthcheck + auto-rollback

Phase 8 of v0.3. Tightens the update lifecycle on both ends.

Pre-flight (apply.go, before any download):
- Free-space check on the passive partition: image size + 10% headroom must
  be available. Uses statfs(2) via the new pkg/partition.FreeBytes /
  HasFreeSpaceFor helpers (tests cover happy path, tiny request, huge
  request, missing path). Catches corrupted-FS and shrunk-partition cases
  before we destroy the existing slot data.
- Node-block-label check: refuses if the local K8s node carries the
  updates.kubesolo.io/block=true label. New pkg/health.CheckNodeBlocked
  shells out to kubectl per the project's zero-deps stance. Silently bypassed
  when no kubeconfig is reachable (air-gap case). Skipped by --force.

Healthcheck (extended via new pkg/health/extended.go + preflight.go):
- CheckKubeSystemReady waits until every kube-system pod has held the Running
  phase for >= N seconds (default 30). Catches "started ok, will crash-loop"
  bugs that a single-shot phase check misses.
- CheckProbeURL fetches an operator-supplied URL; 200 = pass. Wired through
  update.conf as healthcheck_url= and cloud-init updates.healthcheck_url.
- CheckDiskWritable writes/fsyncs/reads a 1-KiB probe under /var/lib/kubesolo.
  Always runs in healthcheck so a wedged data partition fails fast.
- pkg/health.Status grows KubeSystemReady, ProbeURL, DiskWritable booleans.
  Optional checks default to true in RunAll() so they don't block when
  unconfigured. health_test.go updated to the new 6-field shape.

Auto-rollback (healthcheck.go):
- state.UpdateState gains HealthCheckFailures (consecutive post-Activated
  failures). Reset on a clean pass.
- --auto-rollback-after N (also auto_rollback_after= in update.conf) triggers
  env.ForceRollback() when the failure count reaches the threshold. State
  transitions to RolledBack with a descriptive LastError. The command still
  exits with the healthcheck error; the operator/init is expected to reboot.
- Only fires while Phase == Activated. Doesn't second-guess a long-stable
  system that happens to fail one healthcheck.

config / opts / cloud-init plumbing:
- update.conf gains healthcheck_url= and auto_rollback_after= keys.
- New CLI flags: --healthcheck-url, --auto-rollback-after, --kube-system-settle.
- cloud-init full-config.yaml documents the new updates: subfields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

update/cmd/apply.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"os"
 	"runtime"
 	"time"
 
 	"github.com/portainer/kubesolo-os/update/pkg/config"
+	"github.com/portainer/kubesolo-os/update/pkg/health"
 	"github.com/portainer/kubesolo-os/update/pkg/image"
 	"github.com/portainer/kubesolo-os/update/pkg/oci"
 	"github.com/portainer/kubesolo-os/update/pkg/partition"
@@ -71,6 +73,19 @@ func Apply(args []string) error {
 			window.String())
 	}
 
+	// Node-block-label gate — workload authors can defer an update by
+	// labeling the node updates.kubesolo.io/block=true. Skipped with --force
+	// and silently bypassed when the K8s API isn't reachable (air-gap).
+	if !opts.Force {
+		blocked, berr := health.CheckNodeBlocked("")
+		if berr != nil {
+			slog.Warn("node-block check failed, allowing update", "error", berr)
+		} else if blocked {
+			return fmt.Errorf("node carries label %s=true; refusing update (pass --force to override)",
+				health.NodeBlockLabel)
+		}
+	}
+
 	st, err := state.Load(opts.StatePath)
 	if err != nil {
 		// Don't block the operation on a corrupt state file. Log + recover.
@@ -186,6 +201,30 @@ func Apply(args []string) error {
 	}
 	defer partition.Unmount(mountPoint)
 
+	// Free-space pre-write check: the passive partition must have at least
+	// (kernel + initramfs) + 10% headroom. Catches corrupted-FS reports and
+	// shrunk/wrong-size partitions before we destroy the existing slot data.
+	var imgSize int64
+	for _, p := range []string{staged.VmlinuzPath, staged.InitramfsPath} {
+		fi, ferr := os.Stat(p)
+		if ferr != nil {
+			_ = st.RecordError(opts.StatePath, fmt.Errorf("stat staged file %s: %w", p, ferr))
+			return fmt.Errorf("stat staged file %s: %w", p, ferr)
+		}
+		imgSize += fi.Size()
+	}
+	avail, ok, ferr := partition.HasFreeSpaceFor(mountPoint, imgSize, 10)
+	if ferr != nil {
+		_ = st.RecordError(opts.StatePath, fmt.Errorf("free-space check: %w", ferr))
+		return fmt.Errorf("free-space check: %w", ferr)
+	}
+	if !ok {
+		err := fmt.Errorf("insufficient space on %s: have %.1f MiB, need %.1f MiB (image + 10%% headroom)",
+			passiveSlot, float64(avail)/(1<<20), float64(imgSize)*1.1/(1<<20))
+		_ = st.RecordError(opts.StatePath, err)
+		return err
+	}
+
 	// Write image to passive partition
 	if err := partition.WriteSystemImage(mountPoint, staged.VmlinuzPath, staged.InitramfsPath, staged.Version); err != nil {
 		_ = st.RecordError(opts.StatePath, fmt.Errorf("writing system image: %w", err))