slice 10B: signed-op job completion (DELETE clear-job) (hub v0.10.0)

Add DELETE /hosts/{id}/jobs/{job_id} (per-host self-scoped, idempotent) so the
agent clears a job after executing or terminally rejecting it. The hub stores
the operator-signed blobs opaquely (no signing key — cannot forge or open);
the agent verifies + executes. Doc 03 §4/§6/§9 updated (operator-signed path
live; 8C wipe completes; 10B done).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Felhom Hub — Changelog
 
+## v0.10.0 — slice 10B: signed-op job completion (clear-job) (2026-06-10)
+
+The hub half of slice 10B is small by design — the hub stores + serves the operator-signed blobs
+**opaquely** (it holds no signing key and can neither forge nor open them; the agent verifies +
+executes). 10B adds the missing **completion** path so a processed job leaves the queue.
+
+### Added
+- **`DELETE /api/v1/hosts/{host_id}/jobs/{job_id}`** (per-host key, **self-scoped**; the global key
+  may clear any) — the agent calls it after executing OR terminally rejecting a job. Idempotent
+  (clearing an absent job is a clean 200). Store: `DeleteSignedJob`.
+
+### Unchanged (already in 10A, reused by 10B)
+- `POST /admin/hosts/{id}/jobs` (operator enqueues the signed blob), `GET /hosts/{id}/jobs` (the
+  agent fetches), and the `has_signed_ops` envelope flag. The signed blob stays opaque on the wire
+  (a base64 `{op_blob_b64, sig_armored}` envelope the agent parses) — **no jobs-wire golden change**.
+
+### Tests
+- `DELETE …/jobs/{id}` is self-scoped (host A cannot clear host B's job → 403) and idempotent.
+
 ## v0.9.0 — slice 10A: desired-state serving + signed-jobs queue (the "Down" channel) (2026-06-10)
 
 The hub half of slice 10A: the hub now **serves operator intent** down to already-authenticated