feat(report): v0.139.0 — immediate out-of-cycle hub report on user actions (Direction 1)

New report.Trigger (buffered-1 chan + worker; quiet 2s, min spacing 15s,
trailing-edge coalescing) generalizes the v0.70.0 geo out-of-band push.
One canonical fire closure in main.go; wired: geo save/sync + app
deploy/remove/delete (api reportPushNow), escrow recovery-code claim,
notification-prefs save, app-email toggle, offsite config + per-app
toggle, customer claim (web SetReportTrigger seam, nil-safe, fired only
after a successful local commit). 15-min hub-report cycle untouched as
the reconciliation backbone; hub.enabled=false stays a strict no-op.
Tests: trigger engine (2 red-proofs), seam fires-after-commit-only,
nil-seam no-ops.

controller/internal/web/escrow_handlers.go

@@ -284,6 +284,10 @@ func (s *Server) escrowClaimAPIHandler(w http.ResponseWriter, r *http.Request) {
 	}); err != nil {
 		s.logger.Printf("[WARN] [web] escrow claim: ceremony timestamp not persisted: %v", err)
 	}
+	// v0.139.0: the blob is already uploaded at claim time — an immediate report lets the
+	// hub's ACK hash-match flip pending→escrowed in seconds (EscrowAutoConfirmer, unchanged)
+	// instead of after the next ~15-min cycle. Non-blocking; a failed push degrades to the cycle.
+	s.reportTriggerNow()
 	escrowJSON(w, http.StatusOK, map[string]any{"recovery_code": code}, "")
 	code = "" // drop the reference promptly (GC caveat: best-effort)
 	_ = code