v0.107.0: key-auth-first bridge + staged-secret wipe on escrow confirm

Key-auth-first: a KeyAuthProber seam lets the bridge skip consume+install
when the already-installed key still authenticates (pinned to the freshly
verified host key) — descriptor changes on provisioned guests no longer
loop on consume-404. Fingerprint verify still precedes everything.

Wipe-on-escrowed: confirm-escrow now calls the agent's new
DELETE /escrow/stage-secret (v0.78.0) best-effort, closing the hygiene gap
where a ceremony-less confirm left the staged password file behind.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/web/offbox_handlers.go

@@ -122,9 +122,30 @@ func (s *Server) offboxConfirmEscrowHandler(w http.ResponseWriter, r *http.Reque
 		return
 	}
 	s.logger.Printf("[INFO] [web] off-box escrow confirmed — offsite runs enabled")
+	// Fork-4 hygiene: the staged copy on the agent has served its purpose — wipe it. Best-effort: a wipe
+	// failure is logged LOUDLY but does not fail the confirm (the state flip is the primary effect; a
+	// lingering file is a hygiene gap, not a correctness one — re-confirm retries the wipe).
+	if err := s.wipeStagedEscrow(r.Context()); err != nil {
+		s.logger.Printf("[ERROR] [web] escrow confirmed but the agent-staged secret was NOT wiped (re-confirm to retry): %v", err)
+	}
 	offboxRedirect(w, r, "A kulcs letétbe helyezése megerősítve — a NAS-mentés mostantól futhat.", false)
 }
 
+// wipeStagedEscrow calls the injected seam (tests), else the agent's DELETE /escrow/stage-secret over the
+// pinned local-API channel (agent >= v0.78.0).
+func (s *Server) wipeStagedEscrow(ctx context.Context) error {
+	if s.wipeStagedEscrowFn != nil {
+		return s.wipeStagedEscrowFn(ctx)
+	}
+	client, err := s.agentClient()
+	if err != nil {
+		return err
+	}
+	wctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	return client.WipeStagedEscrowSecret(wctx)
+}
+
 // offboxInjectPasswordHandler pre-places a RECOVERED repo password at the offbox password path (fork-4 DR
 // seam) so a subsequent configure uses it and the existing offsite repo opens. Operator/DR only; the value
 // is never logged. Body: {password, force?}.