v0.111.0: remote app-log diagnostics — error context capture (±5 lines, capped+redacted) + on-demand log tails via ACK pull pattern

- metrics: LogIssue.Context on first-occurrence errors (≤11 lines, ≤400 chars/line, warns carry none); RedactLine sanitizer (password/token/api-key/bearer/64-hex) applied to everything shipped; FetchContainerLogTail
- report: 16KB per-report context budget (lowest-count issues dropped first); log_tail_requests ACK flag → next report ships log_tails (200 lines, ≤64KB/app head-truncated, ordered, redacted); consume-once drain
- tests: synthetic-window context capture, caps, redaction, budget order, consume-once, fetch-error skip

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/cmd/controller/main.go

@@ -443,6 +443,10 @@ func main() {
 			// SLICE 3: run the escrow auto-confirm on the same ACK (after the config refresh decision —
 			// a refresh-restart re-enters here anyway on the next cycle).
 			escrowConfirmer.Reconcile(resp.Escrow)
+			// v0.111.0: operator log-tail requests ride the same ACK (pull pattern — the hub
+			// never reaches in). The NEXT report cycle collects + ships the tails; the hub
+			// clears its pending request on receipt. An empty list clears any stale local set.
+			report.SetPendingLogTails(resp.LogTailRequests)
 		}
 		// Wire hub push status into alert manager for dashboard alerts
 		alertMgr.SetHubPushStatus(func() web.HubPushStatusData {