offsiteapply: include QuotaGB in the descriptor hash — quota changes re-apply

A hub-side quota raise now reaches the target: the marker hash changes and
the bridge re-applies via key-auth-first (no password consumed). Test:
quota-only change remaps the new quota with a panicking consumer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/offsiteapply/offsiteapply_test.go

@@ -144,6 +144,25 @@ func TestBridge_AppliesEndToEnd(t *testing.T) {
 	}
 }
 
+// SLICE 4 — a quota-only descriptor change re-applies (the hash includes QuotaGB), and with a working
+// key it costs no password: key-auth-first re-pins + remaps the quota.
+func TestBridge_QuotaChangeReappliesWithoutConsume(t *testing.T) {
+	b, cons, _, en, _ := newBridge(t, goodOffsite())
+	cons.panics = true
+	b.Prober = &fakeProber{pem: "EXISTINGPEM", ok: true}
+	// marker for the OLD quota (25) already applied; the descriptor now says 50
+	old := b.Cfg.Offsite
+	old.QuotaGB = 25
+	_ = os.MkdirAll(filepath.Dir(b.MarkerPath), 0o700)
+	_ = os.WriteFile(b.MarkerPath, []byte(descriptorHash(old)), 0o600)
+	if err := b.Reconcile(context.Background()); err != nil {
+		t.Fatalf("quota-change reconcile: %v", err)
+	}
+	if en.calls != 1 || en.gotQuotaGB != 50 {
+		t.Fatalf("a quota raise must re-apply and map the NEW quota (no consume): %+v", en)
+	}
+}
+
 // Key-auth-first (Scenario B) — the existing key still works: NO consume, NO install; re-verify + re-pin +
 // reconfigure with the EXISTING key, marker updated.
 func TestBridge_KeyAuthFirstSkipsConsume(t *testing.T) {