fix: implement host-filesystem state file with transition detection

The contract said the state file was written after every scan, but the script
had no state-file logic at all. This PR adds:

1. Host filesystem scanning (probe_host_filesystems) - probes df on all PVE nodes
2. State file I/O (read_state_file/write_state_file) - absolute path from script location
3. Band classification (classify_band) - HOST-WARN/AMBER/RED thresholds
4. Transition detection (detect_transitions) - alerts on escalation/recovery
5. CLI flags (--hosts-only, --guests-only) to control which parts run

The contract now specifies the state file path resolves from the script's own
location (not CWD-relative), so two different execution contexts cannot write
to two different places.

state/host-disk-bands.json

@@ -0,0 +1,18 @@
+{
+  "acerpve//": "GREEN",
+  "acerpve//media/mediastore": "GREEN",
+  "acerpve//media/storage": "GREEN",
+  "amdpve//": "GREEN",
+  "amdpve//media/mediastore": "GREEN",
+  "amdpve//media/storage": "GREEN",
+  "storepve//": "GREEN",
+  "storepve//media/easystore2": "HOST-RED",
+  "storepve//media/mediastore": "GREEN",
+  "storepve//media/reanim": "HOST-WARN",
+  "storepve//media/storage": "GREEN",
+  "minipve//": "GREEN",
+  "minipve//media/storage": "GREEN",
+  "ocupve//": "GREEN",
+  "ocupve//media/mediastore": "GREEN",
+  "ocupve//media/storage": "GREEN"
+}