contract: the desired-state golden gains host_release (byte-identical with hub v0.131.0); TestOSUpdateGolden_Decodes checks it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/hub/osupdate_contract_test.go

@@ -23,8 +23,14 @@ func TestOSUpdateGolden_Decodes(t *testing.T) {
 		t.Fatalf("os_update = %+v", o)
 	}
 	r := o.Release
-	if r.ID != "os-20261004-120000" || r.Snapshot != "20261004T120000Z" || len(r.Packages) != 2 ||
+	if r.ID != "os-guest-20261004-120000" || r.Snapshot != "20261004T120000Z" || len(r.Packages) != 2 ||
 		r.Packages[1].Name != "openssl" || r.Packages[1].Version != "3.5.7-1~deb13u3" || r.Packages[1].Origin != "Debian-Security" {
 		t.Fatalf("release = %+v", r)
 	}
+	// v0.141.0: the host layer's own approved set (`11` §8 step 3).
+	h := o.HostRelease
+	if h == nil || h.ID != "os-host-20261004-120000" || h.Snapshot != "20261004T120000Z" || len(h.Packages) != 1 ||
+		h.Packages[0].Name != "libssl3t64" || h.Packages[0].Origin != "Debian-Security" {
+		t.Fatalf("host_release = %+v", h)
+	}
 }

internal/hub/testdata/desired-state-osupdate.golden.json

@@ -5,12 +5,19 @@
       "ring": 1,
       "enabled": true,
       "release": {
-        "id": "os-20261004-120000",
+        "id": "os-guest-20261004-120000",
         "snapshot": "20261004T120000Z",
         "packages": [
           {"name": "libc6", "version": "2.41-12+deb13u4", "origin": "Debian"},
           {"name": "openssl", "version": "3.5.7-1~deb13u3", "origin": "Debian-Security"}
         ]
+      },
+      "host_release": {
+        "id": "os-host-20261004-120000",
+        "snapshot": "20261004T120000Z",
+        "packages": [
+          {"name": "libssl3t64", "version": "3.5.7-1~deb13u3", "origin": "Debian-Security"}
+        ]
       }
     }
   }