feat(update): pre-flight gates + deeper healthcheck + auto-rollback

Phase 8 of v0.3. Tightens the update lifecycle on both ends.

Pre-flight (apply.go, before any download):
- Free-space check on the passive partition: image size + 10% headroom must
  be available. Uses statfs(2) via the new pkg/partition.FreeBytes /
  HasFreeSpaceFor helpers (tests cover happy path, tiny request, huge
  request, missing path). Catches corrupted-FS and shrunk-partition cases
  before we destroy the existing slot data.
- Node-block-label check: refuses if the local K8s node carries the
  updates.kubesolo.io/block=true label. New pkg/health.CheckNodeBlocked
  shells out to kubectl per the project's zero-deps stance. Silently bypassed
  when no kubeconfig is reachable (air-gap case). Skipped by --force.

Healthcheck (extended via new pkg/health/extended.go + preflight.go):
- CheckKubeSystemReady waits until every kube-system pod has held the Running
  phase for >= N seconds (default 30). Catches "started ok, will crash-loop"
  bugs that a single-shot phase check misses.
- CheckProbeURL fetches an operator-supplied URL; 200 = pass. Wired through
  update.conf as healthcheck_url= and cloud-init updates.healthcheck_url.
- CheckDiskWritable writes/fsyncs/reads a 1-KiB probe under /var/lib/kubesolo.
  Always runs in healthcheck so a wedged data partition fails fast.
- pkg/health.Status grows KubeSystemReady, ProbeURL, DiskWritable booleans.
  Optional checks default to true in RunAll() so they don't block when
  unconfigured. health_test.go updated to the new 6-field shape.

Auto-rollback (healthcheck.go):
- state.UpdateState gains HealthCheckFailures (consecutive post-Activated
  failures). Reset on a clean pass.
- --auto-rollback-after N (also auto_rollback_after= in update.conf) triggers
  env.ForceRollback() when the failure count reaches the threshold. State
  transitions to RolledBack with a descriptive LastError. The command still
  exits with the healthcheck error; the operator/init is expected to reboot.
- Only fires while Phase == Activated. Doesn't second-guess a long-stable
  system that happens to fail one healthcheck.

config / opts / cloud-init plumbing:
- update.conf gains healthcheck_url= and auto_rollback_after= keys.
- New CLI flags: --healthcheck-url, --auto-rollback-after, --kube-system-settle.
- cloud-init full-config.yaml documents the new updates: subfields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

update/cmd/healthcheck.go

@@ -17,6 +17,11 @@ import (
 // State transition: Activated → Verifying → Success on pass, → Failed on fail.
 // If state isn't in Activated (e.g. manual run on a long-stable system), the
 // state file is left alone — healthcheck still does its job.
+//
+// When --auto-rollback-after N is set, consecutive post-Activated failures
+// are counted in state.HealthCheckFailures. On the Nth failure, the agent
+// calls Rollback() and the operator is expected to reboot (this command
+// does not reboot the host — that's policy left to systemd/init).
 func Healthcheck(args []string) error {
 	opts := parseOpts(args)
 	env := opts.NewBootEnv()
@@ -48,18 +53,44 @@ func Healthcheck(args []string) error {
 
 	timeout := time.Duration(opts.TimeoutSecs) * time.Second
 	checker := health.NewChecker("", "", timeout)
+	checker.ProbeURL = opts.HealthcheckURL
+	if opts.KubeSystemSettle > 0 {
+		checker.KubeSystemSettle = time.Duration(opts.KubeSystemSettle) * time.Second
+	}
+	// Probe the data partition every healthcheck so a wedged disk fails fast.
+	checker.DataDir = "/var/lib/kubesolo"
 
-	slog.Info("running post-boot health checks", "timeout", timeout)
+	slog.Info("running post-boot health checks",
+		"timeout", timeout,
+		"probe_url", checker.ProbeURL,
+		"kube_system_settle", checker.KubeSystemSettle)
 
 	status, err := checker.WaitForHealthy()
 	if err != nil {
 		fmt.Printf("Health check FAILED: %s\n", status.Message)
-		fmt.Printf("  containerd: %v\n", status.Containerd)
-		fmt.Printf("  apiserver:  %v\n", status.APIServer)
-		fmt.Printf("  node_ready: %v\n", status.NodeReady)
+		printStatusBreakdown(status)
 		fmt.Println("\nBoot NOT marked successful — system may roll back on next reboot")
+
 		if postActivation {
+			st.HealthCheckFailures++
 			_ = st.RecordError(opts.StatePath, fmt.Errorf("post-boot health check failed: %s", status.Message))
+
+			// Auto-rollback escalation. Only trigger when post-Activated;
+			// don't second-guess a healthy long-running system.
+			if opts.AutoRollbackAfter > 0 && st.HealthCheckFailures >= opts.AutoRollbackAfter {
+				slog.Warn("auto-rollback threshold reached",
+					"failures", st.HealthCheckFailures,
+					"threshold", opts.AutoRollbackAfter)
+				if rerr := env.ForceRollback(); rerr != nil {
+					slog.Error("auto-rollback failed", "error", rerr)
+					return err // return the original healthcheck error
+				}
+				if terr := st.Transition(opts.StatePath, state.PhaseRolledBack, "",
+					fmt.Sprintf("auto-rollback after %d healthcheck failures", st.HealthCheckFailures)); terr != nil {
+					slog.Warn("state transition failed", "phase", state.PhaseRolledBack, "error", terr)
+				}
+				fmt.Println("\nAuto-rollback triggered. Reboot to complete the rollback.")
+			}
 		}
 		return err
 	}
@@ -73,15 +104,32 @@ func Healthcheck(args []string) error {
 	}
 
 	if postActivation {
+		// Reset failure counter on a clean pass.
+		st.HealthCheckFailures = 0
 		if err := st.Transition(opts.StatePath, state.PhaseSuccess, "", ""); err != nil {
 			slog.Warn("state transition failed", "phase", state.PhaseSuccess, "error", err)
 		}
 	}
 
 	fmt.Println("Health check PASSED — boot marked successful")
-	fmt.Printf("  containerd: %v\n", status.Containerd)
-	fmt.Printf("  apiserver:  %v\n", status.APIServer)
-	fmt.Printf("  node_ready: %v\n", status.NodeReady)
+	printStatusBreakdown(status)
 
 	return nil
 }
+
+// printStatusBreakdown emits a human-readable per-check summary. Only emits
+// optional check lines when they actually ran.
+func printStatusBreakdown(s *health.Status) {
+	fmt.Printf("  containerd:        %v\n", s.Containerd)
+	fmt.Printf("  apiserver:         %v\n", s.APIServer)
+	fmt.Printf("  node_ready:        %v\n", s.NodeReady)
+	if !s.KubeSystemReady {
+		fmt.Printf("  kube-system pods:  %v\n", s.KubeSystemReady)
+	}
+	if !s.ProbeURL {
+		fmt.Printf("  probe URL:         %v\n", s.ProbeURL)
+	}
+	if !s.DiskWritable {
+		fmt.Printf("  disk writable:     %v\n", s.DiskWritable)
+	}
+}