v0.19.0: bootstrap contract v2 — relay hub retrieval passphrase (no host key in guest)

Lockstep with felhom-controller v0.40.0. The agent now bakes a v2 bootstrap.json
carrying only what the controller needs to PULL its config from the hub:
customer.id + hub.url + hub.retrieval_password + the per-guest local_api. Stops
baking the agent's host hub key/host_id (and customer name/domain/email) into the
guest — the controller gets the customer-scoped key from the hub pull.

- internal/provision/doc.go: SchemaV2; DocCustomer{id}; DocHub{url,retrieval_password}.
- backhalf.go: render v2; require customer.id + hub.url + hub.retrieval_password.
- cmd/.../main.go --selftest=provision: new required -hub-password flag; stop
  baking APIKey/HostID; -customer-domain/name/email accepted but not baked.
- configs/build-golden.sh: default CONTROLLER_IMAGE off stale :v0.35.0 -> :0.40.0.
- doc_test.go/backhalf_test.go updated to v2 shape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/provision/doc.go

@@ -10,14 +10,20 @@ package provision
 
 import "encoding/json"
 
-// SchemaV1 is the stable agent→controller contract version. It MUST stay byte-compatible with the
-// controller's internal/bootstrap.SchemaV1 / Bootstrap shape (cross-repo contract; doc_test.go
-// pins the key set, mirroring the controller's bootstrap_test.go).
-const SchemaV1 = "felhom.bootstrap/v1"
+// SchemaV2 is the stable agent→controller contract version. It MUST stay byte-compatible with the
+// controller's internal/bootstrap.SchemaV2 / Bootstrap shape (cross-repo contract; doc_test.go
+// pins the key set, mirroring the controller's bootstrap_test.go). v2 changed the contract's
+// MEANING — the controller now PULLS its full controller.yaml from the hub using a per-customer
+// retrieval passphrase (which yields the CUSTOMER-scoped hub key), instead of the agent baking its
+// HOST key. So the agent no longer puts the hub api_key / host id (or customer name/domain/email)
+// into the guest; it relays only the customer id, the hub URL, the retrieval passphrase, and the
+// per-guest local-API handle.
+const SchemaV2 = "felhom.bootstrap/v2"
 
 // Doc is the bootstrap.json the agent emits. Field names + json tags MUST match the controller's
-// internal/bootstrap.Bootstrap exactly. It carries ONLY what the controller needs to come up
-// configured and reach the agent's local API — no registry credential (image is baked).
+// internal/bootstrap.Bootstrap exactly. It carries ONLY what the controller needs to PULL its config
+// (customer id + hub url + retrieval passphrase) and reach the agent's local API — no registry
+// credential (image is baked), no customer-scoped hub key, no CF tokens (those come from the pull).
 type Doc struct {
 	Schema   string      `json:"schema"`
 	Customer DocCustomer `json:"customer"`
@@ -26,16 +32,12 @@ type Doc struct {
 }
 
 type DocCustomer struct {
-	ID     string `json:"id"`
-	Name   string `json:"name"`
-	Domain string `json:"domain"`
-	Email  string `json:"email"`
+	ID string `json:"id"` // the pull target; the hub provides name/domain/email
 }
 
 type DocHub struct {
-	URL    string `json:"url"`
-	APIKey string `json:"api_key"`
-	HostID string `json:"host_id"`
+	URL               string `json:"url"`
+	RetrievalPassword string `json:"retrieval_password"` // SECRET — pulls the full config (incl. the customer key)
 }
 
 type DocLocalAPI struct {