hub v0.63.0 — system-initiated immediacy: wire poke/bump at every mutation site that lacked one

The immediate-sync arc covered only operator-initiated desired-state changes;
system-initiated mutations bumped the generation silently, so a freshly onboarded
box waited a full agent tick for state the hub had already minted (observed live at
slice-C onboarding). Wire the existing, live-proven notifiers into every system site
on the correct plane — call-site wiring only, no new mechanism.

Agent plane (poke.Notifier):
- web/pbsdr.go: PBSDRAutoProvision (the observed lag), ReissuePBSDR (also lifts the
  pbsdrheal reconciler escalation, zero reconciler changes), handlePBSDRReissue —
  each pokes AFTER the successful SetHostDesired, never on a blocked/error path.
- api: new nil-safe Poker seam (PokeHost/PokeAllHosts + SetPoker); handleAdminSetDesiredState
  pokes the target host; handleAdminSetOperatorPeer fires PokeAllHosts only when the
  fleet generation bump succeeded (fire-after-commit).
- main.go: one poke.Notifier now feeds both planes (SetPoke + SetPoker).

Controller plane (intent.Hub.Bump):
- api/reissueOnReenroll: one nil-guarded bump so a long-polling controller wakes in
  seconds instead of on the 15-min cycle.

Deliberate non-sites (unchanged): WG register (undeliverable pre-tunnel — the agent
fast-tick SECONDARY owns it), WG delete (transport removed), pbsdrheal Restage (no
generation bump → the 60s ticker is the pickup path). internal/pbsdrheal byte-unchanged.

Tests: 10 non-hollow tests (web async channel-synchronized fake sender; api synchronous
fake Poker) with explicit zero-count negatives; representative red-proofs per group
(A/B/C/D) run-fail-restored. Green: go build/vet/test all pass.

hub/cmd/hub/main.go

@@ -444,8 +444,12 @@ func main() {
 			}, logger); err != nil {
 				logger.Printf("[ERROR] agent-plane poke disabled: %v", err)
 			} else {
-				webServer.SetPoke(poke.NewNotifier(dataStore, pokeClient, logger))
-				logger.Printf("[INFO] agent-plane poke enabled (endpoint %s, user %s)", wgAddr, wgUser)
+				// One notifier, both planes' system-initiated sites (v0.63.0): the web server's
+				// pbsdr writes AND the api handler's admin desired-state / operator-peer writes.
+				n := poke.NewNotifier(dataStore, pokeClient, logger)
+				webServer.SetPoke(n)
+				apiHandler.SetPoker(n)
+				logger.Printf("[INFO] agent-plane poke enabled (endpoint %s, user %s; web + api admin seams armed)", wgAddr, wgUser)
 			}
 		} else {
 			logger.Printf("[INFO] agent-plane poke disabled (key or endpoint not configured)")