controller v0.69.0: remove dead infra-backup stubs + unused restic-password report field

Controller half of Phase-1 Infra Backup retirement (hub v0.12.0;
SPIKE-infra-backup-2026-06-15). Pure dead-code removal, no behaviour change.

- Remove Pusher.PushInfraBackup (caller-less; hub endpoint gone).
- Remove Notifier.NotifyBackupCompleted / backup_completed event (caller-less
  since slice 8C; hub deadline check now reads agent host-report PBS snapshots).
- Remove report.BackupReport.ResticPassword — builder never sets it post-8C
  (confirmed in source + live), but it historically leaked the restic password
  into the hub's plaintext reports store.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/README.md

@@ -963,7 +963,6 @@ The controller pushes structured events to the Hub's `/api/v1/event` endpoint. T
 
 | Event Type | Severity | Trigger |
 |------------|----------|---------|
-| `backup_completed` | info | Nightly restic backup succeeds |
 | `backup_failed` | error | Nightly restic backup fails |
 | `db_dump_completed` | info | Nightly database dumps succeed |
 | `db_dump_failed` | error | Nightly database dumps fail |
@@ -1242,9 +1241,18 @@ Each report push now includes per-app telemetry data:
 - `buildAppTelemetrySection()` calls both, then `buildAppTelemetry()` aggregates by stack — summing container metrics, merging issues, capping at 10 per app. Additionally, `buildControllerTelemetry()` creates a special entry for the controller container itself (`app_name: "felhom-controller"`).
 - Results stored as `[]AppTelemetry` in the `Report` struct field `app_telemetry`.
 
-#### Infrastructure Backup to Hub (`internal/report/infra_backup.go`)
+#### Infrastructure Backup to Hub — RETIRED (2026-06-16)
 
-After each backup cycle (including manual Tier 2 triggers via `OnCrossDriveComplete` callback), the controller pushes a full infrastructure snapshot to the Hub for disaster recovery. This snapshot includes:
+> **Removed.** The controller no longer pushes any infra-backup to the Hub, and the Hub no longer
+> accepts or stores one (hub v0.12.0). The builder (`internal/report/infra_backup.go`) and local
+> mirror (`internal/backup/local_infra.go`) were deleted back in slice 8C; the last caller-less stub
+> (`Pusher.PushInfraBackup`) and the `backup_completed` event were removed in controller v0.69.0.
+> DR now rests on the agent's PBS whole-CT snapshot + the Hub-generated controller.yaml. The text
+> below is **historical** and describes the removed mechanism — much of this section (and the
+> `local_infra.go` / `setup/scanner.go` / `PullRecovery` / `restore_drives` references elsewhere in
+> this README) is stale slice-8C debt. See `felhom.eu/documentation/audits/SPIKE-infra-backup-2026-06-15.md`.
+
+After each backup cycle (including manual Tier 2 triggers via `OnCrossDriveComplete` callback), the controller pushed a full infrastructure snapshot to the Hub for disaster recovery. This snapshot included:
 - `controller.yaml` (base64-encoded, full config including secrets)
 - `settings.json` (base64-encoded, backup prefs, storage paths, cross-drive configs)
 - Disk layout (UUIDs, labels, mount points, fstab options, bind-mount topology)