agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/dr_recipe.go

@@ -21,6 +21,7 @@ import "sort"
 //   - restic_repo_coord — RESERVED for a future offsite bulk-volume backup tier. None exists today:
 //     external-drive data has no offsite/second-failure-domain copy (cross-drive backup is rsync to
 //     the SAME internal SSD), so the field named nothing real. Re-add when that tier ships.
+//
 // The pbs coord, by contrast, is resolved LIVE each collect (LiveSnapshotReporter) so the restore
 // SOURCE is present whenever PBS is reachable — not gated on the 6 h verify cadence.
 //