v0.111.0: remote app-log diagnostics — error context capture (±5 lines, capped+redacted) + on-demand log tails via ACK pull pattern

- metrics: LogIssue.Context on first-occurrence errors (≤11 lines, ≤400 chars/line, warns carry none); RedactLine sanitizer (password/token/api-key/bearer/64-hex) applied to everything shipped; FetchContainerLogTail
- report: 16KB per-report context budget (lowest-count issues dropped first); log_tail_requests ACK flag → next report ships log_tails (200 lines, ≤64KB/app head-truncated, ordered, redacted); consume-once drain
- tests: synthetic-window context capture, caps, redaction, budget order, consume-once, fetch-error skip

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/report/pusher.go

@@ -40,6 +40,10 @@ type PushResponse struct {
 	// Escrow (SLICE 3) is the hub's escrow status for this customer — the input to the hub-verified
 	// auto-confirm (EscrowAutoConfirmer). nil = no escrow row on the hub (or an old hub) → stays pending.
 	Escrow *EscrowStatus `json:"escrow"`
+	// LogTailRequests (v0.111.0) — app names the operator wants a log tail for. Same
+	// pull-based ACK-flag pattern as escrow: the NEXT report ships the tails; the hub
+	// clears the pending request on receipt (consume-once). Absent/empty = nothing pending.
+	LogTailRequests []string `json:"log_tail_requests"`
 }
 
 // Pusher sends reports to the central hub.