agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/loop_test.go

@@ -38,7 +38,9 @@ func (r *fakeReporter) Report(ctx context.Context, _ *HostReport) (*ControlEnvel
 // recordingObserver records the envelopes the loop hands it (slice 10A EnvelopeObserver seam).
 type recordingObserver struct{ envs []*ControlEnvelope }
 
-func (o *recordingObserver) OnEnvelope(_ context.Context, e *ControlEnvelope) { o.envs = append(o.envs, e) }
+func (o *recordingObserver) OnEnvelope(_ context.Context, e *ControlEnvelope) {
+	o.envs = append(o.envs, e)
+}
 
 // The loop notifies the EnvelopeObserver once per successful cycle (with the envelope) AND still
 // adopts PollIntervalSeconds — the two are independent.