v0.28.0: backup re-target → felhom-pbs (offsite DR) + operator-signed decommission

- BackupConfig.BackupTarget() defaults whole-guest backup to felhom-pbs (separate
  hardware = real DR), configurable via backup.local_backup_target; all NewBackupRunner
  sites route through it. PBS round-trip proven live (snapshot marker + restore-test +
  pct-restore) before the re-point.
- signedjobs DecommissionExecutor + ExecutorChain: makes IntentDecommissioned reachable
  ONLY via a verified operator signature (keyed by the watchdog's storage durable-id);
  felhom-opsign builds decommission params from -durable-id. Runner wiring moved below
  the intent-store open.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,35 @@
 All notable changes to **felhom-agent** are recorded here. Update on every code
 change that gets pushed.
 
+## v0.28.0 — backup re-target → felhom-pbs (offsite DR) + operator-signed decommission (2026-06-12)
+
+**Whole-guest backup now defaults to the offsite PBS tier (real DR).** `BackupConfig.BackupTarget()`
+returns the configured `backup.local_backup_target` or, when empty, the new default `felhom-pbs` — a
+PBS datastore on SEPARATE HARDWARE (the DooPlex box), so a host disk/hardware failure no longer takes
+the backups with it. The target stays fully configurable (set `local_backup_target` to `local`/other
+to override); no call site hardcodes it. All `NewBackupRunner` sites (restore-test scheduler, local-API,
+`--selftest=backup`/`restore-test`) route through `BackupTarget()`.
+
+Proven live on demo-felhom before the re-point (PHASE 0 gate):
+- snapshot-mode `vzdump → felhom-pbs` still fires the `create storage snapshot 'vzdump'` marker, so the
+  8B.2 early-resume/quiesce signal survives a PBS target (the marker is mode-driven, not target-driven);
+- the restore-test enumerates PBS backups through the SAME generic `StorageContent`
+  (`/nodes/<node>/storage/felhom-pbs/content` returns `content:"backup"` + ctime/vmid/volid), so
+  `PickRestoreCandidate`/`latestArchive` need NO PBS-client change;
+- `pct restore` from a PBS volid round-trips cleanly (storage.cfg encryption key applied transparently);
+- PBS gotchas (`ignore-verified`, node-from-UPID, privsep) touch only the verify-API path, not vzdump/restore.
+
+**Operator-signed `decommission` now reachable (slice 10 P3 completion).** The previously-unreachable
+`IntentDecommissioned` state (no production caller) is now reached ONLY via a gate-VERIFIED operator
+signature — never customer-confirmable, distinct from a safe eject. New `internal/signedjobs`
+`DecommissionExecutor` (op `decommission`, classified destructive in `reconcile.Classify`) calls
+`IntentStore.SetDecommissioned`, keyed by the drive's STORAGE durable-id (the watchdog's key, e.g.
+`uuid:<fs-uuid>` — NOT the device-level `byid:/byuuid:` scheme `storage_wipe` uses), so the recorded
+intent actually gates future remounts. New `ExecutorChain` lets the signed-jobs runner serve both
+`storage_wipe` and `decommission`; the runner wiring moved below the intent-store open in `main.go`.
+`felhom-opsign` builds decommission params from `-durable-id`. No controller/customer UI — the operator
+path is hub jobs-queue → signed-jobs runner.
+
 ## v0.27.0 — slice 10 P3: self-heal watchdog reconcile + 4-state intent model (2026-06-12)
 
 The storage watchdog goes from detect-only → detect-and-reconcile: the agent autonomously re-mounts an