docs for v0.206.0: CHANGELOG, CONTEXT, REUSE, README

CHANGELOG v0.206.0 with the ruling that reversed the fix, the three changes,
the SEC 7.2 staleness decision, Q7's closed trap, and the two bugs the tests
caught rather than review.

CONTEXT carries the three rules this session established, in the form the next
session needs them:
  - a box does not create a repository key while the hub holds a sealed
    package for it;
  - the fact that answers a question must be kept where the question is asked;
  - fix the state, do not remember that it is wrong.

REUSE gains four rows, each carrying the trap rather than just the signature:
the mint guard is a CONJUNCTION and t.Enabled is load-bearing in the derived
predicate; the discriminator ships INERT unless wired in main.go's confirmer
literal; the countdown removes BOTH halves or neither and must be driven by an
injected clock; and the epoch must be synced FIRST and unconditionally or the
falling edge is lost.

README documents the three customer-visible changes and the operator levers.

No version literal was edited: the controller version is ldflags-only.

controller/README.md

@@ -167,6 +167,30 @@ backups, monitoring and notifications. All Proxmox/disk operations are delegated
   reads); a disconnected/decommissioned drive has its own signal. The manual „Távoli mentés most”
   also refuses SYNCHRONOUSLY when a run is already in flight, instead of answering „elindult” and
   leaving the previous run's verdict on the card.
+  **The box does not mint a repository key over a sealed package (v0.206.0, R-241):**
+  `WriteOffboxSecrets` auto-generated on ONE input — does the password file exist — while its two
+  neighbours in the same file both consulted `GetHubEscrowIdentityPresent()`. A rebuilt box's
+  credential self-heal therefore wrote a fresh key over the package the hub was holding for it, and
+  the recovery screen then correctly reported that nothing was recoverable under the key the box
+  held. The guard is a CONJUNCTION (a package held AND no key present), so a first-time box mints
+  exactly as before; the refusal is a HOLDING state that still writes the transport and declares
+  `offsite.state=awaiting_recovery_key`, so `/recovery` can bring the tier up the moment the key
+  arrives. `--abandon-status` / `--abandon-extend=N` / `--abandon-stop` are the operator levers.
+  **The recovery offer has a third shape (v0.206.0, R-241):** shape (c) — *the hub holds a package
+  for a key OTHER than the one we are using*. Shapes (a) "no key at all" and (b) "a run proved the
+  repo will not open" are proxies for that question and have each been wrong in opposite directions.
+  The comparison was already computed on every report ACK and persisted nowhere; it now lives in
+  `settings.HubEscrowKeySHA256`. A KNOWN difference offers however old the reading; a hash never
+  learned falls back to (a)/(b).
+  **Abandoning the old history is a finishable thing (v0.206.0, R-241):** the customer's confirmed
+  set-aside starts a **14-day countdown**, visible on Távoli mentés and reversible by recovering with
+  the code, at the end of which the set-aside store AND the hub's retained sealed package are removed
+  TOGETHER (two-phase commit; the hub half is `PurgeSupersededEscrowForCustomer`, hub v0.98.0).
+  Afterwards shape (c) has nothing to compare and the offer ends because the state is right. The
+  recovery screen appears **once per ENTRY into the offered state** (an epoch), the reminder bar is
+  per-visit, the durable opt-out silences the bar only, and **none of the three removes the entry
+  point on Távoli mentés**. While a recovery is outstanding, „Helyreállítási kód létrehozása" is
+  UNAVAILABLE — creating a new code would put the earlier history beyond every shipped path.
   (traefik/cloudflared/filebrowser) get curated Hungarian display identity from the
   `inframeta.go` map (name + description + generic `/static/infra-logo.svg` fallback icon);
   filebrowser is the only infra stack with a customer link (`files.<domain>`).