v0.83.0: observability pass — always-DEBUG capture ring + GET /debug/logs + heartbeat log-pull + gap-fill sweep

Capture layer: applog.New returns (logger, Ring) — slog fan-out, stderr at the
configured level, ~1000-entry ring fixed at LevelDebug (remote diagnostics
without a config flip). GET /debug/logs (token-authed, ?raw=1) + request-level
DEBUG middleware. Heartbeat log-pull mirrors the report logtail pattern:
envelope log_tail_requested -> next heartbeat carries log_tail (128KB cap,
consume-once, failed-push retry proven). Gap-fill sweep over netverify/
netstorage/netmount/signedjobs/selfupdate/disks/controller-swap/desired/loop.
Red-proofs: ring-at-emit-level FAILs capture test; drain removed FAILs
consume-once; dropped phase line FAILs the S7 log-sequence smoke.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/signedjobs/runner.go

@@ -14,6 +14,7 @@ import (
 	"fmt"
 	"log/slog"
 	"sync"
+	"time"
 
 	"gitea.dooplex.hu/admin/felhom-agent/internal/authz"
 	"gitea.dooplex.hu/admin/felhom-agent/internal/hub"
@@ -98,10 +99,17 @@ func (r *Runner) RunOnce(ctx context.Context) (int, error) {
 	r.mu.Unlock()
 	defer func() { r.mu.Lock(); r.running = false; r.mu.Unlock() }()
 
+	start := time.Now()
 	jobs, err := r.source.Jobs(ctx)
 	if err != nil {
 		return 0, fmt.Errorf("signedjobs: fetch jobs: %w", err)
 	}
+	ids := make([]string, len(jobs))
+	for i, j := range jobs {
+		ids[i] = j.JobID
+	}
+	r.logger.Debug("signedjobs: jobs fetched", "count", len(jobs), "ids", ids,
+		"duration_ms", time.Since(start).Milliseconds())
 	processed := 0
 	for _, j := range jobs {
 		if r.processJob(ctx, j) {
@@ -122,6 +130,11 @@ func (r *Runner) processJob(ctx context.Context, j hub.JobWire) bool {
 		return true
 	}
 
+	// Op received — class/target/expiry only, NEVER the signature or nonce material.
+	r.logger.Debug("signedjobs: op received",
+		"job", j.JobID, "op", ob.Op, "target_host", ob.Target.HostID,
+		"issued_at", ob.IssuedAt.Format(time.RFC3339), "expires_at", ob.ExpiresAt.Format(time.RFC3339))
+
 	intent := reconcile.Intent{
 		Class:      reconcile.OpClass(ob.Op),
 		HostID:     ob.Target.HostID,