agent v0.38.0: DR recipe — emit secret-free storage/guest/PBS half in host-report

DR recipe slice (agent half), grounded in SPIKE-dr-recipe-2026-06-16. Additive
`dr_recipe` host-report section = the non-secret reconstruction scaffolding the
operator must rebuild before PBS bytes can land. Built by pure
BuildDRRecipeHostHalf from facts the report already collects (no new reads):
guests[] sizing, drives[] (user-data by durable_id/role/mount/intent),
pve_storage[] (storage.cfg), pbs coordinates.

BOUNDARY (Phase-1 lesson): every field is an identifier/intent/size/coordinate —
never a key/password/token/hash/ENC:. PBS key stays in escrow; restic password
stays in escrow; the recipe names only the coordinates the restore targets.

Tests: BuildDRRecipeHostHalf selection, NoPBS, NoSecrets (boundary mirror),
dr_recipe key-set in the cross-repo golden contract test. recipe_version=1,
ignore-unknown on read.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/hub/testdata/host-report.golden.json

@@ -131,5 +131,29 @@
     }
   ],
   "cloudflared": { "status": "active" },
-  "audit_tail": []
+  "audit_tail": [],
+  "dr_recipe": {
+    "recipe_version": 1,
+    "guests": [
+      { "vmid": 100, "cores": 2, "memory_bytes": 2147483648, "disk_bytes": 21474836480 }
+    ],
+    "pbs": {
+      "repo_id": "felhom-pbs",
+      "namespace": "root",
+      "latest_snapshot_id": "9001"
+    },
+    "drives": [
+      {
+        "durable_id": "uuid:0fc63daf-8483-4772-8e79-3d69d8477de4",
+        "role": "",
+        "mount_path": "/mnt/usb-backup",
+        "intent": "enrolled",
+        "total_bytes": 2000000000000
+      }
+    ],
+    "pve_storage": [
+      { "name": "local-lvm", "type": "lvmthin", "content": "rootdir,images" },
+      { "name": "usb-backup", "type": "usb", "content": "backup" }
+    ]
+  }
 }