v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

Capture layer: applog.New returns (logger, Ring) — slog fan-out, stderr at the
configured level, ~1000-entry ring fixed at LevelDebug (remote diagnostics
without a config flip). GET /debug/logs (token-authed, ?raw=1) + request-level
DEBUG middleware. Heartbeat log-pull mirrors the report logtail pattern:
envelope log_tail_requested -> next heartbeat carries log_tail (128KB cap,
consume-once, failed-push retry proven). Gap-fill sweep over netverify/
netstorage/netmount/signedjobs/selfupdate/disks/controller-swap/desired/loop.
Red-proofs: ring-at-emit-level FAILs capture test; drain removed FAILs
consume-once; dropped phase line FAILs the S7 log-sequence smoke.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/desired/syncer.go

@@ -12,6 +12,7 @@ package desired
 import (
 	"context"
 	"log/slog"
+	"time"
 
 	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/reconcile"
@@ -66,12 +67,17 @@ func (s *Syncer) OnEnvelope(ctx context.Context, env *hub.ControlEnvelope) {
 	if env.DesiredGeneration <= have {
 		return // cached: the heavy desired-state moves only on a generation advance
 	}
+	s.logger.Debug("desired: generation advanced — fetching desired-state",
+		"have_generation", have, "envelope_generation", env.DesiredGeneration)
+	start := time.Now()
 	resp, err := s.fetcher.FetchDesiredState(ctx)
 	if err != nil {
 		s.logger.Warn("desired: fetch failed; keeping cached desired-state",
 			"have_generation", have, "envelope_generation", env.DesiredGeneration, "err", err)
 		return
 	}
+	s.logger.Debug("desired: fetched", "generation", resp.Generation,
+		"duration_ms", time.Since(start).Milliseconds())
 	state := mapWire(resp.DesiredState, s.logger)
 	// Cache against the FETCHED generation (not the envelope's) — robust to a generation that
 	// advanced again between the heartbeat and this fetch (we won't re-fetch the same state).