agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/collect.go

@@ -60,6 +60,7 @@ type Collector struct {
 	pbs          PBSReporter
 	temp         TempReader                                    // slice 9: host CPU/chassis temp (nil-safe → nil temp)
 	capProbe     func(ctx context.Context) []capability.Status // v0.44.0: privileged-capability self-check (nil → empty)
+	leafFP       string                                        // v0.48.0: served local-API leaf fp (static per process; "" when local API disabled)
 	hostID       string
 	agentVersion string
 	logger       *slog.Logger
@@ -101,6 +102,14 @@ func (c *Collector) SetCapabilityProber(probe func(ctx context.Context) []capabi
 	return c
 }
 
+// SetLeafFingerprint records the served local-API leaf fp (v0.48.0) to ride every host report (the hub
+// watches it for a re-key). Static per process — set once at startup. "" when the local API is
+// disabled. Returns the collector for chaining.
+func (c *Collector) SetLeafFingerprint(fp string) *Collector {
+	c.leafFP = fp
+	return c
+}
+
 // Collect builds the report. Best-effort liveness: a failed NodeStatus is a hard
 // error (no useful report — the cycle skips the POST); a failed per-guest
 // GuestConfig degrades that guest to status="unknown" without spec but still sends;
@@ -126,9 +135,10 @@ func (c *Collector) Collect(ctx context.Context) (*HostReport, error) {
 		RestoreTests:   c.collectRestoreTests(ctx),
 		PBSSnapshots:   c.collectPBSSnapshots(ctx),
 
-		AuditTail:    []AuditEntry{},
-		Cloudflared:  Cloudflared{Status: c.cloudflaredStatus(ctx)},
-		Capabilities: c.capabilities(ctx),
+		AuditTail:       []AuditEntry{},
+		Cloudflared:     Cloudflared{Status: c.cloudflaredStatus(ctx)},
+		Capabilities:    c.capabilities(ctx),
+		LeafFingerprint: c.leafFP,
 	}
 	// DR recipe host-half — derived from the just-collected guest/storage/PBS facts (no new reads).
 	// Secret-free by construction (identifiers/intents/sizes/coordinates only).