controller v0.94.0: pull-based config-refresh (re-pull + self-restart on config_version change)

PushResponse.ConfigVersion from the report ACK; ConfigRefresher reconciles vs.
the last-applied version (settings.applied_config_version) and on a change calls
bootstrap.RefreshConfig (re-pull controller.yaml + re-merge local_api) then
GracefulSelfRestart. First-run records baseline (no restart); unchanged = no-op
(no storm); failed pull keeps config + retries. Companion to hub v0.26.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

controller/cmd/controller/main.go

@@ -362,6 +362,20 @@ func main() {
 				updater.SetFloor(resp.MinControllerVersion)
 				updater.MaybeAutoUpdate()
 			}
+			// Config-refresh (v0.26.0): the ACK also carries the per-customer config_version. On a
+			// change vs. the last-applied version, re-pull controller.yaml (re-merging local_api from
+			// bootstrap.json) and self-restart so the new config loads. Pull-based — the hub never
+			// connects into the box. Rides this same report cycle; no new timer, no agent. First-ever
+			// ACK records the baseline without restarting; a failed pull keeps the current config and
+			// retries next cycle; an unchanged version is a no-op (so no restart storm).
+			cr := &report.ConfigRefresher{
+				Applied: sett.GetAppliedConfigVersion,
+				Record:  sett.SetAppliedConfigVersion,
+				Refresh: func() error { return bootstrap.RefreshConfig(*configPath, logger, pull) },
+				Restart: func() { api.GracefulSelfRestart(logger) },
+				Logger:  logger,
+			}
+			cr.Reconcile(resp.ConfigVersion)
 		}
 		// Wire hub push status into alert manager for dashboard alerts
 		alertMgr.SetHubPushStatus(func() web.HubPushStatusData {