hub v0.117.0: the status follows the configured threshold; slow crash loop and interrupted restore events

R-549 (operator ruling A): controllerStatus hardcoded 30m/1h while both
staleness checkers and hostStatus read alerting.stale_threshold. Moving the
threshold to 45m would have painted a customer amber 15 minutes before the
alarm could fire - the second definition rollup.go's header forbids. It now
reads the same value, down at 2x. Both 'checker initialized' log lines print
the threshold, which no line did before.

R-539 (ruling 3 of 2026-09-16): controller_slow_crashloop (warning,
operator-only), minted when the agent's slow_crashloop_since moves, with the
fast sibling's first-sight rule.

R-550: restore_interrupted (warning, for the household) allowlisted with a
Hungarian customer message.

Red-proofs, each seen failing then passing: the status test with the old
hardcoded numbers; the checker test with the movement branch removed; the
operator-only test with the registration removed; the household-message test
with the Hungarian entry removed (asserted on the SUBJECT - the body
legitimately repeats the raw message, which my first version of the test
mistook for a fallback).

go build/vet/test ./... green, 18 packages.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/notify/dispatcher.go

@@ -594,6 +594,8 @@ var operatorOnlyEvents = map[string]bool{
 	// mints the types.
 	"controller_restarted_by_agent": true,
 	"controller_crashloop":          true,
+	// R-539 (v0.117.0) — the slow sibling: same audience, same reason.
+	"controller_slow_crashloop": true,
 	// R-518 / R-514 (v0.114.0, controller v0.243.0). A whole-guest tier skipped for absent storage is a
 	// provisioning fact the household cannot act on; an OOM-killed app process carries raw container
 	// names — the household's side is the dashboard tag. Registered in the same commit.