controller v0.178.0 — R-88 Part 2: only a positive 'never' fires the valve

MinAgent: 0.105.0. scheduledRunAllowed fired on any nil age; it now requires a
licence from valveLicensed, which grants it for AgeStateAbsent and for a LEGACY
agent, and refuses it for AgeStateUnknown. An unreadable storage no longer
masquerades as a first-ever backup and no longer quiesces apps outside the window.

A missing wire field means legacy, not unknown — deliberately. Treating it as
unknown would stop the valve firing on un-upgraded boxes and starve genuinely new
ones. Degrade logged once; unrecognised future values also map to legacy.

Caught in passing: TieredBackend is satisfied by a RUNTIME assertion, so the
signature change compiled and vetted clean while quiesceBackend silently stopped
satisfying it — which would have degraded every box to the single-tier path with
no error. Added a compile-time witness.

Also corrects the notifier comment that claimed operator-only came from a missing
customerMessages entry; enforcement is hub-side operatorOnlyEvents (hub 0.79.0).

controller/internal/notify/notifier.go

@@ -791,8 +791,11 @@ func statusRank(status string) int {
 // — while it is still retrying behind the R-88 breaker. A customer can take no action on a failed
 // whole-guest backup; that is the same harm R-97b removes, re-introduced through the front door.
 //
-// These follow the R-85 precedent exactly: a type in the hub's `allowedEventTypes` with NO
-// `customerMessages` entry, so the dispatcher structurally cannot route it to a customer.
+// Operator-only is enforced hub-side by `notify.operatorOnlyEvents` (hub >= v0.79.0, R-97c), NOT by
+// the absence of a `customerMessages` entry — v0.177.0 claimed the latter and was WRONG: the hub
+// falls back to the raw message when the entry is missing, and the only customer gate is
+// `prefs.EnabledEvents`, which is configuration. Adding a type to the allowlist does NOT make it
+// operator-only; it must go in that register too.
 //
 // HUB DEPENDENCY: both types MUST be present in the hub's allowedEventTypes or POST /event 400s
 // (the recorded allowlist gotcha). Do not deploy this controller ahead of that hub change.