docs+config: operator email enabled (Part A, proven) + TESTRUN findings closed

Part A: hub-config operator_email/operator_enabled (committed earlier);
operator + customer email paths proven end-to-end via real Resend sends.
Append the "Findings closed" section to the TESTRUN audit (Part A proof,
F2-a root cause + deploy fix, F2-b fix + live validation, pending §D
supervised reboot) and remove the stale duplicate "Final state" block.
REPORT overwritten. hub/CHANGELOG entry. No hub image change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0162BnMpUXscPsUB1cU8Tr6K

hub/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Felhom Hub — Changelog
 
+## hub-config — enable operator email alerts (config-only, no image change) (2026-06-30)
+
+`manifests/hub.yaml` `hub-config` ConfigMap: set `notifications.operator_email: admin@felhom.eu` +
+`operator_enabled: true`. The dispatcher's operator path (`Dispatcher.processOperator`) sends only when
+`operatorOn && operatorEmail != ""`; without these it returned early, so the self-health pipeline
+(probe → report → checker → dispatch) stopped one hop short of the inbox (the TESTRUN's unproven hop).
+**No hub image change** (live tag stays v0.22.1) — ConfigMap edit + pod restart to reload.
+- **Proven end-to-end (2026-06-30):** a real capability-degrade alert produced
+  `[INFO] Operator email sent for demo-felhom/agent_capability_degraded` (the send-success line that
+  never fired while the path was gated); the customer path (`POST /api/v1/notify` `event_type:test`) sent
+  to the customer address via the same `sendEmail` → Resend. See
+  `documentation/audits/TESTRUN-fullstack-2026-06-29.md` ("Findings closed", Part A). Operator email is not
+  a secret; the Resend key stays injected from `Secret/resend-api`.
+
 ## v0.22.1 — wire HostLeafChecker into the monitor loop (v0.22.0 missed the wiring) (2026-06-29)
 
 The v0.22.0 commit added `HostLeafChecker` but the `cmd/hub/main.go` goroutine edit never applied, so