hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

R-549 (operator ruling A): controllerStatus hardcoded 30m/1h while both
staleness checkers and hostStatus read alerting.stale_threshold. Moving the
threshold to 45m would have painted a customer amber 15 minutes before the
alarm could fire - the second definition rollup.go's header forbids. It now
reads the same value, down at 2x. Both 'checker initialized' log lines print
the threshold, which no line did before.

R-539 (ruling 3 of 2026-09-16): controller_slow_crashloop (warning,
operator-only), minted when the agent's slow_crashloop_since moves, with the
fast sibling's first-sight rule.

R-550: restore_interrupted (warning, for the household) allowlisted with a
Hungarian customer message.

Red-proofs, each seen failing then passing: the status test with the old
hardcoded numbers; the checker test with the movement branch removed; the
operator-only test with the registration removed; the household-message test
with the Hungarian entry removed (asserted on the SUBJECT - the body
legitimately repeats the raw message, which my first version of the test
mistook for a fallback).

go build/vet/test ./... green, 18 packages.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/05-hub-architecture.md

@@ -85,8 +85,8 @@ These two streams are the bottom-up mirror of §1 — they keep the hub current
 
 ## 4. Liveness / dead-man's-switch
 
-Evolves the existing staleness checker (60s **cadence**, 30m/1h **thresholds** — OK <30m, down at
-2× = >1h; today: controller-report recency → `node_stale`/`down`/`recovered`):
+Evolves the existing staleness checker (60s **cadence**, a **configured** threshold — 30 m until
+2026-09-17, **45 m** since operator ruling A on R-549; OK under it, down at 2× = 90 m; today: controller-report recency → `node_stale`/`down`/`recovered`):
 
 - **Primary = host-report recency → `host_stale` / `host_down`.** The agent heartbeat is the box's
   liveness signal; a silent agent = the box is gone (the critical alert).