v0.6.0: slice 6 Phase B — PBS offsite tier (verify + PBS-API client + reporting)

Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is
the verify capability, a small PBS-API client, and PBSSnapshot reporting.

- internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/
  TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime,
  never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled,
  like the watchdog) + SnapshotStore.
- hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/
  verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional
  key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN.
- backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade
  snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir.
  --selftest=pbs-verify. Backup/restore-to-PBS unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/contract_test.go

@@ -59,8 +59,15 @@ func TestHostReport_ContractMatchesGolden(t *testing.T) {
 				Pass: true, Verified: "boot+running", TestedAt: "2026-06-09T11:05:00Z", DurationSeconds: 1,
 			},
 		},
-		PBSSnapshots: []PBSSnapshot{}, AuditTail: []AuditEntry{},
-		Cloudflared:  Cloudflared{Status: "active"},
+		PBSSnapshots: []PBSSnapshot{
+			{
+				Namespace: "root", BackupType: "ct", BackupID: "9001", BackupTime: "2026-06-09T14:18:33Z",
+				SizeBytes: 1, Owner: "felhom@pbs!n100", Protected: false, Encrypted: true,
+				VerifyState: "ok", VerifyUPID: "UPID:dooplex:x:verify:felhom-spike:u:",
+			},
+		},
+		AuditTail:   []AuditEntry{},
+		Cloudflared: Cloudflared{Status: "active"},
 	}
 	b, _ := json.Marshal(report)
 	var got map[string]any
@@ -82,6 +89,8 @@ func TestHostReport_ContractMatchesGolden(t *testing.T) {
 	// slice-6 additions — backups[0] / restore_tests[0] key sets (the bidirectional guard).
 	assertSameKeys(t, "backups[0]", firstElem(golden["backups"]), firstElem(got["backups"]))
 	assertSameKeys(t, "restore_tests[0]", firstElem(golden["restore_tests"]), firstElem(got["restore_tests"]))
+	// slice-6-Phase-B addition — pbs_snapshots[0] key set.
+	assertSameKeys(t, "pbs_snapshots[0]", firstElem(golden["pbs_snapshots"]), firstElem(got["pbs_snapshots"]))
 }
 
 // field extracts a nested object value from a decoded JSON map (nil if absent/not a map).