v0.108.0: hub-verified escrow auto-confirm on current-password hash match (SLICE 3)

EscrowAutoConfirmer flips pending->escrowed ONLY when sha256(local repo
password) matches the ACK's restic_pw_sha256 (blob-presence alone never
confirms — red-proofed). Mismatch warns once per hash naming the ceremony;
never un-confirms; wipes the staged secret on flip. Pinned cross-repo hash
vector; manual confirm deprecated to a legacy-blob fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/report/pusher.go

@@ -37,6 +37,9 @@ type PushResponse struct {
 	// delivery — the hub never connects into the box). 0 = the hub didn't advertise it (old hub, or a
 	// report-only customer with no config row) → the controller does nothing.
 	ConfigVersion int `json:"config_version"`
+	// Escrow (SLICE 3) is the hub's escrow status for this customer — the input to the hub-verified
+	// auto-confirm (EscrowAutoConfirmer). nil = no escrow row on the hub (or an old hub) → stays pending.
+	Escrow *EscrowStatus `json:"escrow"`
 }
 
 // Pusher sends reports to the central hub.