hub v0.89.0 — the two halves of decision D-c (R-167, R-158)

New OPERATOR-ONLY event type recovery_unit_capture_failed (controller
v0.191.0, R-158): in allowedEventTypes AND notify.operatorOnlyEvents.
Deliberately not a reuse of backup_failed, which carries customer copy and
sits in the controller's DefaultEnabledEvents — reusing it would email the
customer in Hungarian about a failure they cannot act on. R-158's own
proposal said backup_failed; D-c overrides it.

disk_warning/disk_critical lose their generic customerMessages entries.
Both were allowlisted, copy'd, default-enabled and checkbox'd with NO
producer anywhere; controller v0.191.0 becomes that producer and sends a
DYNAMIC Hungarian message naming the drive and its free space.
FormatCustomerEmail prefers the entry over the message, so keeping a static
entry would discard the label and the byte figures — the same reason
offbox_enlarge_blocked and disk_health_degraded have none. The deletion is
pinned by a test.

New notify.IsOperatorOnly so the api package can pin BOTH registers of a new
event type in ONE test; allowlisted-but-not-operator-only is invisible when
they are checked separately, and it is the defect v0.78.0 shipped. The
register itself stays unexported.

REUSE.md's "new event type" extension point rewritten: it told readers to
always add a customerMessages entry, which is wrong for operator-only types
and harmful for dynamic-message ones.

Tests 574 -> 579. Red-proof: removing the operatorOnlyEvents entry shows the
customer being emailed; the skipped/operator_only row is asserted as a
positive observable.

hub/internal/notify/templates.go

@@ -71,9 +71,20 @@ var customerMessages = map[string]string{
 	"offbox_repo_orphaned": "A távoli mentési tároló elárvult: a benne lévő mentések egy korábbi, már nem elérhető kulccsal készültek (jellemzően újratelepítés után). Új mentés a tároló visszaállításáig nem készül — nyisd meg a Távoli mentés oldalt.",
 	"offbox_repo_reset":    "A távoli mentési tároló visszaállítva: a régi előzmény félretéve (nem törölve), és egy üres, új tároló jött létre a mostani kulccsal.",
 
-	// Disk events (GUEST — the controller's own cgroup view)
-	"disk_warning":  "A lemezterület 90% felett van — kérjük, szabadíts fel helyet.",
-	"disk_critical": "A lemezterület kritikusan magas (95%+) — azonnali beavatkozás szükséges!",
+	// Disk events (GUEST — the controller's own view) — `disk_warning` / `disk_critical`.
+	//
+	// DELIBERATELY NO ENTRY, from hub v0.89.0 / controller v0.191.0 (R-167, decision D-c). These two
+	// types were allowlisted here, carried generic Hungarian copy, sat in the controller's
+	// DefaultEnabledEvents and had a UI checkbox — and NOTHING IN ANY REPO EMITTED THEM. A complete
+	// customer pipeline with no producer; the sixth "built but never wired" instance in this project.
+	// The controller became their producer in v0.191.0.
+	//
+	// The producer sends a DYNAMIC Hungarian message naming the filesystem and its free space, so a
+	// static entry here would be actively harmful: FormatCustomerEmail PREFERS the entry over the
+	// message, so re-adding one would discard the drive name and the byte figures and leave the
+	// customer with "A lemezterület 90% felett van" — a warning with nothing to act on. Same reason
+	// `offbox_enlarge_blocked` and `disk_health_degraded` have no entry. Pinned by
+	// TestDiskFillTypesHaveNoGenericCustomerMessage.
 
 	// Host disk events (the Proxmox HOST root filesystem — distinct from the guest disk above)
 	"host_disk_warning":  "A házszerver alaprendszerének (Proxmox-gazda) gyökérlemeze 90% felett van — kérjük, szabadíts fel helyet (pl. régi biztonsági mentések).",