v0.256.0: the box sends its own sentence in the household's language (R-558 Part B)

MinAgent: 0.131.0 (unchanged). Needs hub v0.118.0+, which shipped first and
tolerates a box that sends none of this - every box in the fleet is that box
until this release reaches it.

The hub writes a household's e-mails in their language now, but about a third
of those mails carry a sentence the BOX composed, naming a drive, an app or a
number. The hub cannot translate one. So the box sends it twice.

- message_customer on POST /api/v1/event, omitempty. A HUNGARIAN household
  sends nothing extra at all, so its payload stays byte-for-byte what every box
  sends today and the hub's fallback path keeps being the one production
  exercises rather than a branch nobody takes.
- 19 producers render both sentences from ONE bundle key. `message` stays
  Hungarian always: it is what the operator is mailed and what the hub logs.
- customer.language bootstraps a new box - stored choice, then config, then
  Hungarian. The config value is NEVER written into settings.json: that would
  record a choice the household never made.

The Hungarian did not move, measured twice: the wire golden from the slice-2
base commit, and the Go parity gate over all 19 new keys.

Three guards had to learn the change and one caught me: the test seam now
carries the new field; the R-329 severity register reported two dynamic sites
as no longer existing the moment they moved off PushEvent (the walk now checks
36 severity literals, up from 20); and TestConfigLanguageIsWiredInMain reads
main.go, because cmd/ is gitignored and ripgrep does not.

A mistake, named: the first pass dropped displayName from three producers,
which would have mailed customers "Alkalmazás telepítve: %!s(MISSING)". Caught
reading the diff; now pinned by a test that refuses %!/MISSING/%s/%d in either
language.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/config/config.go

@@ -142,10 +142,16 @@ type SystemConfig struct {
 }
 
 type CustomerConfig struct {
-	ID             string `yaml:"id"`
-	Name           string `yaml:"name"`
-	Domain         string `yaml:"domain"`
-	Email          string `yaml:"email"`
+	ID     string `yaml:"id"`
+	Name   string `yaml:"name"`
+	Domain string `yaml:"domain"`
+	Email  string `yaml:"email"`
+	// Language (v0.256.0, R-558) is the language the OPERATOR chose when creating this customer, as
+	// rendered by the hub into controller.yaml. It is the language this box STARTS in and nothing
+	// more: the moment the household picks one on the dashboard, settings.json holds their choice
+	// and this value is never consulted again. A config pull therefore cannot overwrite a
+	// household's choice. Empty (an older hub, or a hand-written config) means Hungarian.
+	Language       string `yaml:"language"`
 	TelegramChatID string `yaml:"telegram_chat_id"`
 }