agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/report.go

@@ -36,6 +36,13 @@ type HostReport struct {
 	// on a Critical capability flipping to "degraded". Non-nil so it marshals as [].
 	Capabilities []capability.Status `json:"capabilities"`
 
+	// LeafFingerprint is the SHA-256 of the local-API leaf the agent CURRENTLY serves (v0.48.0). The
+	// hub records the first value per host as the baseline and raises `host_leaf_changed` if it ever
+	// changes — a proactive, fleet-wide agent-re-key alert independent of any controller's channel
+	// check. Empty when the local API is disabled (no leaf) → the hub treats "" as unknown, never an
+	// alert. Not a secret (the fp is public; the token is never reported).
+	LeafFingerprint string `json:"leaf_fingerprint"`
+
 	// DR recipe — the agent (storage/guest/PBS) half of the secret-free reconstruction recipe
 	// (SPIKE-dr-recipe-2026-06-16). Derived from the facts above; carries ONLY identifiers/intents/
 	// sizes/coordinates, never a secret. The hub assembles it with the controller's app half.