v0.91.1 — wire the credential probe (v0.91.0 shipped the seam inert)

v0.91.0 built the AuthSink seam and the NoteAuthResult consumer, and main.go never
called SetAuthSink. The reporter skips probing when no sink is attached, so the entire
auth-honesty leg was silently inert — no probe, no auth_failed, no self-heal — and
nothing failed, because every unit test injected the sink directly.

Caught during STOP-1 live verification by checking the wiring instead of trusting it.
Same class as the controller v0.154.0 defect the day before: a table test over a seam
proves the seam, not the caller.

The published 0.91.0 artifact is superseded, not overwritten — a published version stays
immutable. TestLiveReporter_NoSinkMeansNoProbe pins the no-sink-no-probe contract so the
inert case is documented behaviour rather than an accident; only live evidence can prove
the wiring itself.

cmd/felhom-agent/main.go

@@ -864,6 +864,11 @@ func runDaemon(cfg config.Config, logger *slog.Logger, logRing *applog.Ring) int
 		pbsdrLoop = pbsdr.NewLoop(pdMgr, 60*time.Second, logger)
 		desiredSyncer.AddConsumer(pbsdrLoop) // raw desired-state → the pbs_dr block
 		collector.SetPBSDRReporter(pbsdrLoop)
+		// R-39 leg (c): route the live reporter's per-storage credential probe into the DR bridge, so
+		// a 401 becomes a LOUD `auth_failed` the hub self-heals instead of a Warn-and-skip. Without
+		// this wiring the probe seam exists but nothing consumes it — and the reporter deliberately
+		// skips probing when no sink is attached, so the whole leg would be silently inert.
+		pbsReporter.SetAuthSink(pdMgr)
 		// Capability gate wiring (v0.86.0): the prober's GatePBSDR now answers from the bridge
 		// (descriptor state, marker-backed across restarts) — see the capProber block above.
 		drConfigured = pdMgr.DRConfigured