v0.19.0: bootstrap contract v2 — relay hub retrieval passphrase (no host key in guest)

Lockstep with felhom-controller v0.40.0. The agent now bakes a v2 bootstrap.json
carrying only what the controller needs to PULL its config from the hub:
customer.id + hub.url + hub.retrieval_password + the per-guest local_api. Stops
baking the agent's host hub key/host_id (and customer name/domain/email) into the
guest — the controller gets the customer-scoped key from the hub pull.

- internal/provision/doc.go: SchemaV2; DocCustomer{id}; DocHub{url,retrieval_password}.
- backhalf.go: render v2; require customer.id + hub.url + hub.retrieval_password.
- cmd/.../main.go --selftest=provision: new required -hub-password flag; stop
  baking APIKey/HostID; -customer-domain/name/email accepted but not baked.
- configs/build-golden.sh: default CONTROLLER_IMAGE off stale :v0.35.0 -> :0.40.0.
- doc_test.go/backhalf_test.go updated to v2 shape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/provision/backhalf.go

@@ -87,8 +87,11 @@ func (b *BackHalf) Provision(ctx context.Context, in Input) (Result, error) {
 	if in.Endpoint == "" || in.Fingerprint == "" {
 		return Result{}, fmt.Errorf("provision: needs the local-api endpoint and leaf fingerprint")
 	}
-	if in.Customer.ID == "" || in.Customer.Domain == "" {
-		return Result{}, fmt.Errorf("provision: needs customer id and domain (so the controller skips setup)")
+	if in.Customer.ID == "" {
+		return Result{}, fmt.Errorf("provision: needs a customer id (the hub config-pull target)")
+	}
+	if in.Hub.URL == "" || in.Hub.RetrievalPassword == "" {
+		return Result{}, fmt.Errorf("provision: needs hub url + retrieval passphrase (so the controller can pull its config)")
 	}
 	guestPath := in.GuestPath
 	if guestPath == "" {
@@ -109,7 +112,7 @@ func (b *BackHalf) Provision(ctx context.Context, in Input) (Result, error) {
 
 	// 2. Render the stable bootstrap.json contract (with the token injected).
 	doc := Doc{
-		Schema:   SchemaV1,
+		Schema:   SchemaV2,
 		Customer: in.Customer,
 		Hub:      in.Hub,
 		LocalAPI: DocLocalAPI{Endpoint: in.Endpoint, Fingerprint: in.Fingerprint, Token: tok},