v0.89.0: pbsdr self-grant (R-22) + escrow config live-reload + agent-plane poke listener (Direction-2a)

- pbsdr: on a 403 pre-check (non-default storage id, no ACL yet) self-grant via the root wrapper then re-read, instead of aborting before the grant — closes F4/R-22. Red-proof TestSelfGrant_PreCheck403DoesNotAbortBeforeGrant.
- escrow preflight: late-bound CurrentPBSStorageID re-reads agent.json so a pbsdr-seeded pbs_storage_id flips the row green in-process (no restart). Red-proof TestEscrowPreflight_PBSStorageIDLiveReload.
- internal/poke: contentless UDP poke listener bound exclusively to the box WG /32 (port 51822), leading-edge debounced, fires the hub-loop out-of-band trigger for an immediate desired-state cycle. First slice of R-13. Red-proofs TestBindConfinement + TestDebounceCoalescesBurst.

internal/wgtunnel/manager.go

@@ -162,6 +162,29 @@ func (m *Manager) loadMarker() *marker {
 	return &mk
 }
 
+// LoadAssignedAddr reads the box's assigned WG address from the registration marker
+// (<stateDir>/wg/registered.json) WITHOUT constructing a Manager — the poke listener (v0.89.0)
+// binds EXCLUSIVELY to this /32, so it needs the bare address, not the /32 prefix. Returns
+// ok=false until the box has registered (marker absent / unparsable / empty). The address is
+// stable across the box's life (preserved on re-key / reinstall — the WG IP is host-scoped).
+func LoadAssignedAddr(stateDir string) (netip.Addr, bool) {
+	raw, err := os.ReadFile(filepath.Join(stateDir, "wg", markerName))
+	if err != nil {
+		return netip.Addr{}, false
+	}
+	var mk marker
+	if json.Unmarshal(raw, &mk) != nil || mk.AssignedIP == "" {
+		return netip.Addr{}, false
+	}
+	if pfx, err := netip.ParsePrefix(mk.AssignedIP); err == nil {
+		return pfx.Addr(), true
+	}
+	if a, err := netip.ParseAddr(mk.AssignedIP); err == nil { // tolerate a bare addr
+		return a, true
+	}
+	return netip.Addr{}, false
+}
+
 func (m *Manager) writeMarker(mk marker) error {
 	if err := os.MkdirAll(m.wgDir(), 0o700); err != nil {
 		return err