hub v0.60.1: host deletion demotes escrow custody (never destroys) + customer-delete purge point + S6b obsolete

- DeleteHost(deleteEscrow) demotes current host_escrow into host_escrow_superseded (copy-before-delete, same tx), spares existing; one shared demoteCurrentEscrowTx (reused by SaveHostEscrow). F-14 provenance/gate unchanged.
- DeleteCustomerConfig now purges both escrow tables for all the customer's hosts incl. already-deleted (F-14 provenance UNION) — the one true purge point.
- Wording: checkbox/refusal/Danger-zone → demotion. S6b OBSOLETE. Red-proofs TestDeleteHost_Demotes + TestDeleteCustomer_Purges + wording guard.

hub/internal/web/escrow_demote_wording_test.go

@@ -0,0 +1,30 @@
+package web
+
+import (
+	"strings"
+	"testing"
+)
+
+// Scenario C (v0.60.1) — the host-delete escrow checkbox must tell the truth: host deletion DEMOTES
+// the blob to retained custody, it does not destroy it. Guards the wording against a regression.
+func TestHostDeleteEscrowLabel_DemotionWording(t *testing.T) {
+	b, err := templateFS.ReadFile("templates/host_detail_body.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	src := string(b)
+	if !strings.Contains(src, "Move key escrow to retained custody") {
+		t.Error("host-delete escrow checkbox must use demotion wording (retained custody)")
+	}
+	if strings.Contains(src, "Also delete the key escrow") {
+		t.Error("host-delete escrow checkbox still uses destruction wording (regression)")
+	}
+	// The customer Danger-zone copy names the permanent purge of retained custody (the one true point).
+	cb, err := templateFS.ReadFile("templates/customer_unified.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(cb), "retained recovery-key custody") {
+		t.Error("customer Danger-zone copy must name the permanent removal of retained recovery-key custody")
+	}
+}