feat(update): pre-flight gates + deeper healthcheck + auto-rollback

Phase 8 of v0.3. Tightens the update lifecycle on both ends.

Pre-flight (apply.go, before any download):
- Free-space check on the passive partition: image size + 10% headroom must
  be available. Uses statfs(2) via the new pkg/partition.FreeBytes /
  HasFreeSpaceFor helpers (tests cover happy path, tiny request, huge
  request, missing path). Catches corrupted-FS and shrunk-partition cases
  before we destroy the existing slot data.
- Node-block-label check: refuses if the local K8s node carries the
  updates.kubesolo.io/block=true label. New pkg/health.CheckNodeBlocked
  shells out to kubectl per the project's zero-deps stance. Silently bypassed
  when no kubeconfig is reachable (air-gap case). Skipped by --force.

Healthcheck (extended via new pkg/health/extended.go + preflight.go):
- CheckKubeSystemReady waits until every kube-system pod has held the Running
  phase for >= N seconds (default 30). Catches "started ok, will crash-loop"
  bugs that a single-shot phase check misses.
- CheckProbeURL fetches an operator-supplied URL; 200 = pass. Wired through
  update.conf as healthcheck_url= and cloud-init updates.healthcheck_url.
- CheckDiskWritable writes/fsyncs/reads a 1-KiB probe under /var/lib/kubesolo.
  Always runs in healthcheck so a wedged data partition fails fast.
- pkg/health.Status grows KubeSystemReady, ProbeURL, DiskWritable booleans.
  Optional checks default to true in RunAll() so they don't block when
  unconfigured. health_test.go updated to the new 6-field shape.

Auto-rollback (healthcheck.go):
- state.UpdateState gains HealthCheckFailures (consecutive post-Activated
  failures). Reset on a clean pass.
- --auto-rollback-after N (also auto_rollback_after= in update.conf) triggers
  env.ForceRollback() when the failure count reaches the threshold. State
  transitions to RolledBack with a descriptive LastError. The command still
  exits with the healthcheck error; the operator/init is expected to reboot.
- Only fires while Phase == Activated. Doesn't second-guess a long-stable
  system that happens to fail one healthcheck.

config / opts / cloud-init plumbing:
- update.conf gains healthcheck_url= and auto_rollback_after= keys.
- New CLI flags: --healthcheck-url, --auto-rollback-after, --kube-system-settle.
- cloud-init full-config.yaml documents the new updates: subfields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

update/cmd/opts.go

@@ -18,12 +18,15 @@ type opts struct {
 	PubKeyPath        string
 	BootEnvType       string // "grub" or "rpi"
 	BootEnvPath       string // path for RPi boot control dir
-	StatePath         string // location of state.json (default: state.DefaultPath)
-	ConfPath          string // location of update.conf (default: config.DefaultPath)
-	Channel           string // update channel ("stable" by default)
-	MaintenanceWindow string // "HH:MM-HH:MM" or empty for always-allow
-	Force             bool   // bypass maintenance window
-	JSON              bool   // status: emit JSON instead of human-readable
+	StatePath          string // location of state.json (default: state.DefaultPath)
+	ConfPath           string // location of update.conf (default: config.DefaultPath)
+	Channel            string // update channel ("stable" by default)
+	MaintenanceWindow  string // "HH:MM-HH:MM" or empty for always-allow
+	HealthcheckURL     string // optional GET probe for healthcheck
+	AutoRollbackAfter  int    // healthcheck: rollback after N consecutive failures (0=off)
+	KubeSystemSettle   int    // healthcheck: kube-system pods must be Running for N seconds (0=disabled)
+	Force              bool   // bypass maintenance window
+	JSON               bool   // status: emit JSON instead of human-readable
 }
 
 // NewBootEnv creates a BootEnv from the parsed options.
@@ -74,6 +77,12 @@ func parseOpts(args []string) opts {
 		if cfg.PubKey != "" {
 			o.PubKeyPath = cfg.PubKey
 		}
+		if cfg.HealthcheckURL != "" {
+			o.HealthcheckURL = cfg.HealthcheckURL
+		}
+		if cfg.AutoRollbackAfter > 0 {
+			o.AutoRollbackAfter = cfg.AutoRollbackAfter
+		}
 	} else if err != nil {
 		slog.Warn("could not load update.conf", "path", o.ConfPath, "error", err)
 	}
@@ -100,6 +109,43 @@ func parseOpts(args []string) opts {
 			}
 		case "--force":
 			o.Force = true
+		case "--healthcheck-url":
+			if i+1 < len(args) {
+				o.HealthcheckURL = args[i+1]
+				i++
+			}
+		case "--auto-rollback-after":
+			if i+1 < len(args) {
+				n := 0
+				for _, ch := range args[i+1] {
+					if ch >= '0' && ch <= '9' {
+						n = n*10 + int(ch-'0')
+					} else {
+						n = 0
+						break
+					}
+				}
+				if n > 0 {
+					o.AutoRollbackAfter = n
+				}
+				i++
+			}
+		case "--kube-system-settle":
+			if i+1 < len(args) {
+				n := 0
+				for _, ch := range args[i+1] {
+					if ch >= '0' && ch <= '9' {
+						n = n*10 + int(ch-'0')
+					} else {
+						n = 0
+						break
+					}
+				}
+				if n > 0 {
+					o.KubeSystemSettle = n
+				}
+				i++
+			}
 		case "--json":
 			o.JSON = true
 		case "--server":