agent: report served local-API leaf fingerprint (hub re-key detection, Part A) v0.48.0

HostReport.LeafFingerprint rides the served fp (from EnsureLeaf) on every report; empty when local
API disabled. Collector.SetLeafFingerprint threads it like Capabilities. Hub watches it for a re-key.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

internal/hub/report_test.go

@@ -24,13 +24,14 @@ func TestHostReport_FieldNamesAndEmptyCollections(t *testing.T) {
 			VMID: 100, Name: "felhom-cust-acme", Status: "running", ControllerVersion: "",
 			Spec: &GuestSpec{Cores: 2, MemoryBytes: 2147483648, DiskBytes: 21474836480},
 		}},
-		StorageTargets: []StorageTarget{},
-		Backups:        []Backup{},
-		RestoreTests:   []RestoreTest{},
-		PBSSnapshots:   []PBSSnapshot{},
-		AuditTail:      []AuditEntry{},
-		Cloudflared:    Cloudflared{Status: "active"},
-		Capabilities:   []capability.Status{},
+		StorageTargets:  []StorageTarget{},
+		Backups:         []Backup{},
+		RestoreTests:    []RestoreTest{},
+		PBSSnapshots:    []PBSSnapshot{},
+		AuditTail:       []AuditEntry{},
+		Cloudflared:     Cloudflared{Status: "active"},
+		Capabilities:    []capability.Status{},
+		LeafFingerprint: "60b5974d586f5f3c8ec41eb998d0f07406178219c36bf6d3ff377570279d8245",
 	}
 	// dr_recipe is always set on the real path (Collect); set it here too so the "no null" invariant
 	// covers it (empty pbs is omitempty → omitted, never null).
@@ -50,6 +51,7 @@ func TestHostReport_FieldNamesAndEmptyCollections(t *testing.T) {
 		// empty collections must be [] not null
 		`"storage_targets":[]`, `"backups":[]`, `"restore_tests":[]`, `"pbs_snapshots":[]`, `"audit_tail":[]`,
 		`"capabilities":[]`,
+		`"leaf_fingerprint":"60b5974d586f5f3c8ec41eb998d0f07406178219c36bf6d3ff377570279d8245"`,
 	} {
 		if !strings.Contains(got, field) {
 			t.Errorf("report JSON missing %s\n got: %s", field, got)