capability: agent privileged-capability self-probe (manifest + build-test + runtime snapshot) v0.44.0

New internal/capability: Manifest of required sudo -n grants + Prober that LISTS each
via 'sudo -n -l' (never executes) + binary-exists check → ok/degraded snapshot on the hub
report. Build-time test asserts manifest⊆sudoers (red-proof: dropping lxc-info FAILs the
gate). Startup logs N/N ok + ERROR per degraded. Serve-degraded; no allowlist change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

internal/hub/collect.go

@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"time"
 
+	"gitea.dooplex.hu/admin/felhom-agent/internal/capability"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
 )
 
@@ -57,7 +58,8 @@ type Collector struct {
 	backups      BackupReporter
 	restoreTests RestoreTestReporter
 	pbs          PBSReporter
-	temp         TempReader // slice 9: host CPU/chassis temp (nil-safe → nil temp)
+	temp         TempReader                                    // slice 9: host CPU/chassis temp (nil-safe → nil temp)
+	capProbe     func(ctx context.Context) []capability.Status // v0.44.0: privileged-capability self-check (nil → empty)
 	hostID       string
 	agentVersion string
 	logger       *slog.Logger
@@ -92,6 +94,13 @@ func (c *Collector) SetTempReader(t TempReader) *Collector {
 	return c
 }
 
+// SetCapabilityProber wires the privileged-capability self-check (v0.44.0): each collect runs it
+// and attaches the snapshot. nil → the report carries an empty []. Returns the collector for chaining.
+func (c *Collector) SetCapabilityProber(probe func(ctx context.Context) []capability.Status) *Collector {
+	c.capProbe = probe
+	return c
+}
+
 // Collect builds the report. Best-effort liveness: a failed NodeStatus is a hard
 // error (no useful report — the cycle skips the POST); a failed per-guest
 // GuestConfig degrades that guest to status="unknown" without spec but still sends;
@@ -117,8 +126,9 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 		RestoreTests:   c.collectRestoreTests(ctx),
 		PBSSnapshots:   c.collectPBSSnapshots(ctx),
 
-		AuditTail:   []AuditEntry{},
-		Cloudflared: Cloudflared{Status: c.cloudflaredStatus(ctx)},
+		AuditTail:    []AuditEntry{},
+		Cloudflared:  Cloudflared{Status: c.cloudflaredStatus(ctx)},
+		Capabilities: c.capabilities(ctx),
 	}
 	// DR recipe host-half — derived from the just-collected guest/storage/PBS facts (no new reads).
 	// Secret-free by construction (identifiers/intents/sizes/coordinates only).
@@ -126,6 +136,18 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 	return report, nil
 }
 
+// capabilities runs the privileged-capability self-check for this report (v0.44.0), or returns an
+// empty (non-nil) slice when no prober is wired (dev/test). Never fatal — serve-degraded.
+func (c *Collector) capabilities(ctx context.Context) []capability.Status {
+	if c.capProbe == nil {
+		return []capability.Status{}
+	}
+	if s := c.capProbe(ctx); s != nil {
+		return s
+	}
+	return []capability.Status{}
+}
+
 // HostMetricsNow does a FRESH NodeStatus + CPU-temp read and returns just the host block (no
 // guests/storage). It is the source for the local API's GET /host/metrics (slice 9) — current
 // cpu%/temp, not the 15-min hub-report snapshot. Storage targets come from the observer