v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

Capture layer: applog.New returns (logger, Ring) — slog fan-out, stderr at the
configured level, ~1000-entry ring fixed at LevelDebug (remote diagnostics
without a config flip). GET /debug/logs (token-authed, ?raw=1) + request-level
DEBUG middleware. Heartbeat log-pull mirrors the report logtail pattern:
envelope log_tail_requested -> next heartbeat carries log_tail (128KB cap,
consume-once, failed-push retry proven). Gap-fill sweep over netverify/
netstorage/netmount/signedjobs/selfupdate/disks/controller-swap/desired/loop.
Red-proofs: ring-at-emit-level FAILs capture test; drain removed FAILs
consume-once; dropped phase line FAILs the S7 log-sequence smoke.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/hub/report.go

@@ -85,6 +85,15 @@ type HostReport struct {
 	// Carries NO secret.
 	PBSDR *PBSDRStatus `json:"pbs_dr,omitempty"`
 
+	// LogTail is the agent's on-demand debug-ring tail (v0.83.0 observability) — the agent
+	// mirror of the controller's report log_tails channel. Present ONLY on the heartbeat
+	// right after the control envelope requested it (log_tail_requested); consume-once on
+	// both ends (the hub clears its pending request on arrival). Newest lines kept, byte-
+	// capped loop-side. Carries log lines only — the logging conventions forbid secrets in
+	// any log line, and the hub's bundle gate re-checks before storing. `omitempty`: absent
+	// in the steady state, so the cross-repo host-report golden stays byte-stable.
+	LogTail *LogTail `json:"log_tail,omitempty"`
+
 	// OOB is the operator-access health stanza (TASK H1). It answers the operator's question — "can I
 	// get into this box right now, and if not, why" — from the hub: felhom-sshd up + on which port,
 	// locally reachable, the tunnel handshake age (the OOB path rides wg-felhom), whether the operator
@@ -368,6 +377,16 @@ type ControlEnvelope struct {
 	Blocked             bool  `json:"blocked"`            // reserved — ignored
 	DesiredGeneration   int64 `json:"desired_generation"` // slice 10A: the cached-vs-current change signal
 	HasSignedOps        bool  `json:"has_signed_ops"`     // slice 10A: signed-jobs queue non-empty (exec 10B)
+	// LogTailRequested (v0.83.0) — the operator wants this agent's debug-ring tail; the
+	// NEXT heartbeat carries it in log_tail (the report-channel log_tail_requests mirror).
+	// Absent/false on an old hub → nothing happens.
+	LogTailRequested bool `json:"log_tail_requested"`
+}
+
+// LogTail is the heartbeat's on-demand agent log tail (see HostReport.LogTail).
+type LogTail struct {
+	CollectedAt string   `json:"collected_at"` // RFC3339
+	Lines       []string `json:"lines"`
 }
 
 // DesiredStateResponse is GET /hosts/{host_id}/desired-state (slice 10A — the "Down" channel's