agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

CHANGELOG.md

@@ -1,3 +1,17 @@
+## v0.48.0 — report the served local-API leaf fingerprint (hub-side re-key detection, Part A) (2026-06-29)
+
+The agent now rides its **served leaf fingerprint** on every host report so the hub can detect an
+agent re-key fleet-wide (the last self-health leg — `host_leaf_changed`, hub v0.22.0).
+
+- **`internal/hub/report.go`:** new `HostReport.LeafFingerprint string` (`leaf_fingerprint`) — the
+  SHA-256 of the leaf the agent currently serves. Empty when the local API is disabled (no leaf) → the
+  hub treats "" as unknown, never an alert. Not a secret.
+- **`internal/hub/collect.go` + `cmd/felhom-agent/main.go`:** `Collector.SetLeafFingerprint(fp)` threads
+  the `fp` from `EnsureLeaf` (the SAME value the loud LOADED/REGENERATED log reports) into every report,
+  next to `Capabilities`.
+- Tests: the report includes the fp when set, `""` when unset (local API disabled); golden + contract +
+  field-names tests updated (cross-repo golden mirrors `leaf_fingerprint`). Version `0.47.0 → 0.48.0`.
+
 ## v0.47.0 — controller-swap verify hardening: reject a crash-looping no-healthcheck image (F1) (2026-06-29)
 
 Closes F1 from the no-mercy testrun: a controller image with **no HEALTHCHECK that crash-loops** could