hub v0.91.1 — observation may only WIDEN a tier's window, never tighten it (R-86)

Found by checking v0.91.0 against the live box, not by review. demo-felhom's two
retained PBS snapshots sit 8h54m apart (one is a healing artefact), so the
mean-gap estimator reads a WEEKLY tier as nine-hourly: x4 = 36h, the 7-day floor
lifts it to 168h, and a weekly tier proved weekly reaches ~8.25d of proof age.
The false alarm this task exists to prevent would have returned within a week, on
the box it had just shipped to.

restoreProvenWindow now takes max(observed, declared). A gap SHORTER than the
declared rhythm is routine and means nothing (a retry, a manual run, a heal, a
catch-up); a gap LONGER than it is real information. Cost stated: a tier running
faster than its declared rhythm gets a slower stale signal — the right direction
for a signal that means 'unverified', since 'broken now' is a different event.

hub/internal/monitor/restoretest_test.go

@@ -399,6 +399,15 @@ func TestRestoreProvenWindow_Contract(t *testing.T) {
 		{"unobservable local falls back to its declared rhythm", "local", 0, false, restoreProvenWindowFloor},
 		{"unobservable pbs falls back WIDE, not to the floor", "pbs", 0, false, restoreProvenWindowCap},
 		{"a nonsense zero interval is ignored", "pbs", 0, true, restoreProvenWindowCap},
+		// MEASURED ON THE LIVE BOX, and the reason observation may only WIDEN. demo-felhom's two
+		// retained PBS snapshots sit 8h54m apart (one is a healing artefact), so a mean-gap estimate
+		// reads a WEEKLY tier as nine-hourly. Taking that at face value gives 4x9h = 36h → the 7-day
+		// floor → and a weekly tier proved weekly (~8.25d of proof age) alarms within a week of this
+		// shipping, on the box it shipped to.
+		{"a short observed gap must NOT tighten a weekly tier", "pbs", 8*time.Hour + 54*time.Minute, true, restoreProvenWindowCap},
+		{"a short observed gap must not tighten the host tier either", "local", 30 * time.Minute, true, restoreProvenWindowFloor},
+		// ...but a tier that genuinely runs SLOWER than its declared rhythm still widens.
+		{"a genuinely slower tier widens", "local", 4 * 24 * time.Hour, true, restoreProvenWindowCap},
 	}
 	// The relationship Part 1 depends on: a weekly tier's window must be WIDER than a daily tier's,
 	// or proving weekly (which is now correct behaviour) alarms on itself.