v0.78.0: DELETE /escrow/stage-secret — idempotent staged-secret wipe

The staged offsite repo password was wiped only by the escrow-create
ceremony; a confirm without a fresh ceremony (password already escrowed)
left the 0600 staged file behind. The controller calls this on every
EscrowState flip to escrowed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,3 +1,14 @@
+## v0.78.0 — fork-4 hygiene: DELETE /escrow/stage-secret (staged-secret wipe) (2026-07-09)
+
+Part of the offsite-provisioning hardening bundle (pairs with controller v0.107.0 + hub v0.39.0). The staged
+restic repo password was wiped only by the escrow-create ceremony; a confirm WITHOUT a fresh ceremony (the
+password already escrowed — the live e2e's Option A) left the 0600 staged file behind indefinitely.
+
+- `internal/localapi`: `DELETE /escrow/stage-secret` (withGuest) — removes the staged file (+ any stale
+  `.tmp` partial). **Idempotent**: absent file → clean 200 `{removed:false}`. The controller calls it
+  whenever `EscrowState` flips to `escrowed`. No value ever logged (nothing to log — it's a removal).
+- Test: stage → wipe (file GONE) → re-wipe idempotent → 401 unauthenticated.
+
 ## v0.77.0 — fork-4: escrow the offsite restic repo password under R (2026-07-09)
 
 Makes the restic-offsite repo password recoverable at DR by riding the existing customer-recovery-code (R)