hub v0.89.0 — the two halves of decision D-c (R-167, R-158)

New OPERATOR-ONLY event type recovery_unit_capture_failed (controller
v0.191.0, R-158): in allowedEventTypes AND notify.operatorOnlyEvents.
Deliberately not a reuse of backup_failed, which carries customer copy and
sits in the controller's DefaultEnabledEvents — reusing it would email the
customer in Hungarian about a failure they cannot act on. R-158's own
proposal said backup_failed; D-c overrides it.

disk_warning/disk_critical lose their generic customerMessages entries.
Both were allowlisted, copy'd, default-enabled and checkbox'd with NO
producer anywhere; controller v0.191.0 becomes that producer and sends a
DYNAMIC Hungarian message naming the drive and its free space.
FormatCustomerEmail prefers the entry over the message, so keeping a static
entry would discard the label and the byte figures — the same reason
offbox_enlarge_blocked and disk_health_degraded have none. The deletion is
pinned by a test.

New notify.IsOperatorOnly so the api package can pin BOTH registers of a new
event type in ONE test; allowlisted-but-not-operator-only is invisible when
they are checked separately, and it is the defect v0.78.0 shipped. The
register itself stays unexported.

REUSE.md's "new event type" extension point rewritten: it told readers to
always add a customerMessages entry, which is wrong for operator-only types
and harmful for dynamic-message ones.

Tests 574 -> 579. Red-proof: removing the operatorOnlyEvents entry shows the
customer being emailed; the skipped/operator_only row is asserted as a
positive observable.

hub/internal/notify/dispatcher.go

@@ -315,8 +315,20 @@ var operatorOnlyEvents = map[string]bool{
 	// a consequence of another type's routing — true today, and silently untrue the moment the failed
 	// event becomes customer-visible. Belt, not inference.
 	"whole_guest_backup_recovered": true,
+	// R-158 / R-167 (D-c). A per-app Tier-1 recovery-unit capture failure. A customer can take no
+	// action on it — the causes are a full filesystem, a permission fault or a broken dump, all of
+	// which the operator resolves — and the alert carries operator-grade detail (target path, byte
+	// figures, the raw error). The customer's half of D-c is the FILL WARNING, which fires BEFORE
+	// this and is actionable: free space, delete files, add a drive.
+	"recovery_unit_capture_failed": true,
 }
 
+// IsOperatorOnly reports whether an event type is barred from customer dispatch. Exported so the
+// api package can pin BOTH registers of a new event type in one test — allowlisted-but-not-
+// operator-only is the v0.78.0 defect, and it is only visible when the two are checked together.
+// Read-only: the register itself stays unexported so nothing can widen it at runtime.
+func IsOperatorOnly(eventType string) bool { return operatorOnlyEvents[eventType] }
+
 func (d *Dispatcher) processCustomer(customerID, eventType, severity, message, detailsJSON, source string) {
 	// R-97c: operator-tier events stop here, BEFORE prefs are consulted — the point is that no
 	// customer configuration can opt in. Logged rather than dropped, so the skip is visible in