hub: WIRE HostLeafChecker into the monitor loop (the wiring was missed in v0.22.0)

The v0.22.0 commit added the checker but the main.go goroutine edit never applied. Live test caught
it (no host_leaf_changed on a leaf regen). Now started on the 60s sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pg8ANF97SEeKYSN5Jxw3qJ

hub/cmd/hub/main.go

@@ -319,6 +319,9 @@ func main() {
 	// v0.44.0-agent: operator alert when an agent reports a degraded privileged capability (a missing
 	// `sudo -n` grant — the 2026-06-28 cutover class). Same 60s sweep + transition/cooldown plumbing.
 	hostCapabilityChecker := monitor.NewHostCapabilityChecker(dataStore, dispatcher.ProcessEvent, logger)
+	// agent-v0.48.0: proactive fleet-wide agent-re-key detection — alert when a host's reported
+	// local-API leaf fingerprint changes (independent of the controller channel-check). Same 60s sweep.
+	hostLeafChecker := monitor.NewHostLeafChecker(dataStore, dispatcher.ProcessEvent, logger)
 	go func() {
 		ticker := time.NewTicker(60 * time.Second)
 		defer ticker.Stop()
@@ -330,6 +333,7 @@ func main() {
 				stalenessChecker.Check()
 				hostStalenessChecker.Check()
 				hostCapabilityChecker.Check()
+				hostLeafChecker.Check()
 			}
 		}
 	}()