agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/collect_test.go

@@ -146,3 +146,27 @@ func TestCollect_CloudflaredProbeErrorIsUnknown(t *testing.T) {
 		t.Error("empty collections must be non-nil")
 	}
 }
+
+// Part A: the served leaf fp rides the report when set (v0.48.0); empty when the local API is disabled
+// (no SetLeafFingerprint). Companion: the unset case proves the threading is what populates it.
+func TestCollect_LeafFingerprint(t *testing.T) {
+	px := &fakePx{node: "n", ns: newTestNodeStatus()}
+	const fp = "60b5974d586f5f3c8ec41eb998d0f07406178219c36bf6d3ff377570279d8245"
+
+	c := NewCollector(px, fakeProber{status: "active"}, nil, nil, nil, nil, "h", "0.48.0", quietLogger())
+	c.SetLeafFingerprint(fp)
+	r, err := c.Collect(context.Background())
+	if err != nil {
+		t.Fatalf("Collect: %v", err)
+	}
+	if r.LeafFingerprint != fp {
+		t.Fatalf("leaf_fingerprint = %q, want %q", r.LeafFingerprint, fp)
+	}
+
+	// Companion: no SetLeafFingerprint (local API disabled) → empty, never a fabricated value.
+	c2 := NewCollector(px, fakeProber{status: "active"}, nil, nil, nil, nil, "h", "0.48.0", quietLogger())
+	r2, _ := c2.Collect(context.Background())
+	if r2.LeafFingerprint != "" {
+		t.Fatalf("unset leaf_fingerprint = %q, want empty", r2.LeafFingerprint)
+	}
+}