agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/dr_recipe_test.go

@@ -80,7 +80,7 @@ func TestBuildDRRecipeHostHalf_NoPBS(t *testing.T) {
 // TestDRRecipeHostHalf_V1DriveShape pins the v1 host-half drive shape: a drive object carries ONLY
 // {durable_id, mount_path, intent, total_bytes} (fs_type is omitempty) — and specifically NEITHER the
 // dropped "role" NOR "restic_repo_coord" keys. Re-adding either field to DRDrive makes this fail
-// (the companion: `Role string \`json:"role"\`` reintroduces the "role" key → caught here).
+// (the companion: `Role string \`json:"role"\“ reintroduces the "role" key → caught here).
 func TestDRRecipeHostHalf_V1DriveShape(t *testing.T) {
 	h := BuildDRRecipeHostHalf(
 		nil,