agent (unreleased): the hub is told what the kernel clean-up did and what the profile refresh did (R-1383)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/osupdate/kernel_test.go

@@ -400,6 +400,25 @@ func TestKernelCleanup_NightOrderOnceAndNoNames(t *testing.T) {
 	if len(lastRep.Kernel) != 0 || kverRE.MatchString(lastRep.ReleaseID) {
 		t.Fatalf("the clean-up's report names a kernel (the hub reads that as a kernel step): %+v", lastRep)
 	}
+	// R-1383 (release 3): the detail the hub's System page shows — removed, kept, gained, left-overs — rides the same
+	// report as its own object. On the wire it is `kernel_cleanup`, and the report STILL has no `kernel` key.
+	d := lastRep.KernelCleanup
+	if d == nil || len(d.Removed) != 1 || d.Removed[0] != "proxmox-kernel-7.0.14-20-pve-signed" ||
+		strings.Join(d.Kept, ",") != "7.0.14-22-pve,7.0.2-6-pve" || d.BytesGained == nil || *d.BytesGained != 1073741824 || d.Leftovers != 0 {
+		t.Fatalf("the clean-up's detail did not reach the hub: %+v", d)
+	}
+	wire, _ := json.Marshal(lastRep)
+	var keys map[string]json.RawMessage
+	_ = json.Unmarshal(wire, &keys)
+	if _, has := keys["kernel"]; has {
+		t.Fatalf("the clean-up's report carries a `kernel` view on the wire: %s", wire)
+	}
+	if string(keys["kernel_cleanup"]) != `{"removed":["proxmox-kernel-7.0.14-20-pve-signed"],"kept":["7.0.14-22-pve","7.0.2-6-pve"],"bytes_gained":1073741824,"leftovers":0}` {
+		t.Fatalf("kernel_cleanup on the wire = %s", keys["kernel_cleanup"])
+	}
+	if string(keys["release_id"]) != `"kernel-cleanup"` {
+		t.Fatalf("release_id on the wire = %s (a kernel version there is read as a step for it)", keys["release_id"])
+	}
 	// the same night again: the pass is skipped as a whole — never a second clean-up
 	l.Run(context.Background(), 9201, "night")
 	if len(cleanupCalls(w)) != 1 {