capability: agent privileged-capability self-probe (manifest + build-test + runtime snapshot) v0.44.0

New internal/capability: Manifest of required sudo -n grants + Prober that LISTS each
via 'sudo -n -l' (never executes) + binary-exists check → ok/degraded snapshot on the hub
report. Build-time test asserts manifest⊆sudoers (red-proof: dropping lxc-info FAILs the
gate). Startup logs N/N ok + ERROR per degraded. Serve-degraded; no allowlist change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

internal/hub/report.go

@@ -1,6 +1,10 @@
 package hub
 
-import "encoding/json"
+import (
+	"encoding/json"
+
+	"gitea.dooplex.hu/admin/felhom-agent/internal/capability"
+)
 
 // HostReport is the wire contract shared with the hub's ingest
 // (felhom.eu TASK-slice3-hub-ingest). Field NAMES must match the hub
@@ -27,6 +31,11 @@ type HostReport struct {
 	Cloudflared Cloudflared  `json:"cloudflared"`
 	AuditTail   []AuditEntry `json:"audit_tail"` // populated by a later slice
 
+	// Capabilities is the agent's privileged-capability self-check snapshot (v0.44.0): per required
+	// `sudo -n` grant, whether it is permitted + the binary exists. The hub keys its operator alert
+	// on a Critical capability flipping to "degraded". Non-nil so it marshals as [].
+	Capabilities []capability.Status `json:"capabilities"`
+
 	// DR recipe — the agent (storage/guest/PBS) half of the secret-free reconstruction recipe
 	// (SPIKE-dr-recipe-2026-06-16). Derived from the facts above; carries ONLY identifiers/intents/
 	// sizes/coordinates, never a secret. The hub assembles it with the controller's app half.