v0.108.0: hub-verified escrow auto-confirm on current-password hash match (SLICE 3)

EscrowAutoConfirmer flips pending->escrowed ONLY when sha256(local repo
password) matches the ACK's restic_pw_sha256 (blob-presence alone never
confirms — red-proofed). Mismatch warns once per hash naming the ceremony;
never un-confirms; wipes the staged secret on flip. Pinned cross-repo hash
vector; manual confirm deprecated to a legacy-blob fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,5 +1,26 @@
 ## Changelog
 
+### v0.108.0 — SLICE 3: hub-verified escrow auto-confirm (current-password hash match) (2026-07-09)
+
+Replaces operator trust with a verified fact (pairs with agent v0.79.0 + hub v0.40.0): the report ACK now
+carries `escrow:{identity_blob_present, restic_pw_sha256, created_at}` and the controller flips offbox
+`EscrowState` pending→escrowed ONLY when `sha256(local repo_password) == restic_pw_sha256` — i.e. the
+stored escrow provably covers the CURRENT key, not merely "a blob exists" (a stale blob would re-open the
+un-recoverable-ciphertext gap fork-4 closed).
+
+- **`internal/report`:** `PushResponse.Escrow` + `EscrowAutoConfirmer` (long-lived; runs on every ACK):
+  match → flip (`UpdateOffboxStatus`) + wipe the agent-staged secret (the v0.107.0 DELETE path, best-effort
+  loud); mismatch → stays pending + a LOUD warn naming the fix ("run the escrow ceremony"), **deduped per
+  distinct hash** (not per 15-min cycle); no row / NULL hash / hash-without-identity-blob / no local
+  password file → stays pending silently (fail-closed); non-pending → total no-op (**never un-confirms**).
+  **Companion red-proof:** modeled the blob-present-only check → the stale-blob and hash-less scenarios
+  flipped when they must not → tests FAILED. Reverted — hash-match is the load-bearing core.
+- **`internal/backup`:** `HashResticPassword` (canonical: sha256 hex over the TRIMMED string — **pinned
+  cross-repo test vector**, same vector asserted in felhom-agent) + `Manager.OffboxRepoPasswordHash`.
+- **`internal/web`:** the manual `POST /backup/offbox/confirm-escrow` is now a documented **deprecated
+  fallback** for legacy hash-less blobs (e.g. the demo's) — auto-confirm is primary.
+- Hashes are safe to log (non-reversible over a 256-bit random secret); passwords never appear in logs.
+
 ### v0.107.0 — offsite hardening: key-auth-first bridge + staged-secret wipe on confirm (2026-07-09)
 
 Part of the offsite-provisioning hardening bundle (pairs with hub v0.39.0 + agent v0.78.0).