Reinstall could inherit the previous machine's non-secret answers as the form's starting point

[VijitSingh97]

On a fresh-start reinstall (wipe=data/all of a disk that held an install), the operator
re-answers everything, including answers the machine already knows — node modes and hosts,
sidechain, alerts. A bench session lost its remote-Tari setting this way: the form defaulted
Tari to local and the machine started downloading a chain the operator never wanted locally.

The previous config sits on the target's data partition during the installer session. The host
(which already enumerates disks) could, for a pithead-with-data target, mount the data
partition read-only, read pithead/config.json, strip the secrets (dashboard auth, view keys,
node passwords, workers), and publish the remainder to the spool as the form's pre-fill —
exactly the last-attempt.json mechanism the pre-seed path already uses. The operator sees
their old answers as the starting point and changes what they came to change.

Host-side only (the container never mounts anything), read-only, and secrets never reach the
page. Not load-bearing: the form works without it — this is a convenience with a real failure
story behind it.

[VijitSingh97]

Implemented in #805, host-side only, riding the existing last-attempt.json spool channel — the state API and the form needed no changes, since the pre-seed path already proves the consumption end.

Where it enters the flow: in pithead firstboot-wizard, right after publish_disk_inventory. When the inventory holds exactly one pithead-with-data disk, the host mounts its data partition read-only (-t ext4 -o ro,nosuid,nodev), reads pithead/config.json, strips it, and publishes the remainder as $spool/last-attempt.json. Cleared first every installer boot (fleet stick: machine 2 never sees machine 1's answers), and an operator pre-seed outranks it. Ambiguous inventories (two disks with data) publish nothing rather than guess.

Strip list enforced (strip_config_secrets = every CONTROL_SECRET_PATHS leaf + whole-object deletes):

• dashboard.auth (whole object) and the deprecated dashboard.workers
• workers (whole object — api_token plus every per-entry list[].token)
• monero.node_username, monero.node_password, monero.view_key
• tari.view_key, tari.spend_public_key
• p2pool.stratum_password
• telegram (whole — bot token and chat id)
• healthchecks (whole — the ping URL is the credential)
• notifications (whole — ntfy URL and token)
• ssh (whole — the authorized key is an access grant)
• xvb.standby.source

Wallet addresses, node modes and remote hosts/ports, pool tier and timezone survive — the answers the operator came back for. Everything fails open: broken, absent, oversized, symlinked or unmountable previous config means the form opens blank and nothing blocks the install. On wipe=keep the pre-fill is left untouched and no config crosses, as before.

The KVM install phase gained two reinstall-leg assertions (previous wallet pre-fills; no non-empty password anywhere in the page state) for the next bench battery.