agent: EnsureLeaf signals + loud-WARNs a regenerated leaf (prevention B.1) v0.46.0

EnsureLeaf returns generated bool; call-site logs INFO 'leaf LOADED' vs WARN 'leaf REGENERATED —
previously issued bootstrap pins now INVALID'. Catches the 2026-06-28 silent-regen incident class.
Test: first=generated, second=loaded+same fp. No new sudo surface.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

CHANGELOG.md

@@ -1,3 +1,19 @@
+## v0.46.0 — leaf lifecycle: signal + loud-log a regenerated leaf (prevention, Part B.1) (2026-06-29)
+
+Makes an accidental local-API leaf **regeneration** (the 2026-06-28 root→non-root migration class —
+moving `/var/lib/felhom-agent` aside silently minted a new leaf → every controller's pin invalidated
+for days) **visible immediately** instead of silent.
+
+- **`EnsureLeaf` now returns `generated bool`** (`internal/localapi/cert.go`): false = an existing
+  pair was LOADED (stable fingerprint), true = a fresh leaf was GENERATED.
+- **Loud call-site (`cmd/felhom-agent/main.go`):** a load logs `INFO local-api leaf LOADED`; a
+  regeneration logs **`WARN local-api leaf REGENERATED — any previously issued bootstrap pins are now
+  INVALID; controllers will fail the pin check until re-bootstrapped`** (with the new fingerprint).
+- No new sudo/capability surface — pure return + log change. The companion install-script preservation
+  (`--preserve-state-from` + the populated-host guard) lives in `felhom.eu/scripts/felhom-host-install.sh`.
+- Tests: `EnsureLeaf` first call `generated==true`, second `generated==false` AND **same fingerprint**
+  (persistence keeps the pin stable). Version `0.45.0 → 0.46.0`.
+
 # Changelog
 
 All notable changes to **felhom-agent** are recorded here. Update on every code