Merge origin/main (phase 5, drift and merge) into feat/ledger-ui-services-agents-18

Conflicts:
- CLAUDE.md: keep both sets of gotchas (drift/merge from main, SSE ping and
  swarm_cluster_id from this branch).
- internal/imageref/imageref_test.go: keep both TestIsDigest (main) and
  TestIsRegistryHost (this branch).
- internal/master/web/server.go: take main's renderServiceError and make it
  render through s.page, so service error pages get the sidebar nav data.

Also renumber this branch's migration 0005_agent_cluster.sql to
0006_agent_cluster.sql, after main's 0005_drift_merge.sql.

Claude-Session: https://claude.ai/code/session_01GAZsp3P7Qto6JnhipxWUJQ

internal/master/web/server_test.go

@@ -35,6 +35,13 @@ type fakeStore struct {
 	revokedID    int64
 	revokeFailed []int64 // job IDs RevokeAgent reports as failed
 	versions     []model.ImageVersion
+
+	acceptCalls []acceptCall
+	acceptErr   error
+	moves       []model.Move
+	sources     []model.Service
+	merged      [][2]int64 // from, to
+	mergeErr    error
 }
 
 func (f *fakeStore) RecentVersions(_ context.Context, repo string, limit int) ([]model.ImageVersion, error) {
@@ -142,6 +149,9 @@ type fakeJobs struct {
 	triggered   []int64 // version IDs passed to TriggerVersion
 	triggerSvc  []int64 // service IDs passed to TriggerVersion
 	plainCalls  int     // Trigger calls
+
+	restorable error   // returned by Restorable
+	restored   []int64 // service IDs passed to RestoreDesired
 }
 
 func (f *fakeJobs) Updatable(model.Service) error { return f.updatable }