hub v0.16.0 + host-install v1.1.0: Day-0 artifact manifest + self-install the agent (BUNDLE slice)

Hub (v0.16.0):
- store: ArtifactManifest{agent,golden version+sha256} in hub_settings; Get/SetArtifactManifest.
- handler: GET /api/v1/artifacts/{id} (passphrase auth, mirrors config-retrieve). Unset => 200 empty.
- web: operator UI "Day-0 artifacts" card (POST /configs/artifacts), semver + 64-hex validation.
- artifact_test.go: returned-verbatim / unset-empty / 401 / 404 / store round-trip.

host-install (v1.1.0):
- new step 5/8 agent-install: manifest + git token (config-retrieve) -> fetch binary from Gitea ->
  verify sha256 vs hub manifest (abort on mismatch) -> install non-root felhom-agent user + binary +
  sudoers (visudo -cf) + canonical unit. Idempotent.
- new step 7/8 golden: local fallback else fetch+verify+import from Gitea (--force-gitea-golden).
- agent now runs non-root (privileged.mode sudo), config chowned to the service user.
- README prerequisites trimmed to: install PVE + create customer.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/api/handler.go

@@ -203,6 +203,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case r.Method == http.MethodGet && strings.HasPrefix(path, "/config/"):
 		customerID := strings.TrimPrefix(path, "/config/")
 		h.handleConfigRetrieve(w, r, customerID)
+	case r.Method == http.MethodGet && strings.HasPrefix(path, "/artifacts/"):
+		customerID := strings.TrimPrefix(path, "/artifacts/")
+		h.handleArtifactManifest(w, r, customerID)
 	case r.Method == http.MethodGet && path == "/assets/manifest":
 		h.handleAssetsManifest(w, r)
 	case r.Method == http.MethodGet && strings.HasPrefix(path, "/assets/file/"):
@@ -1497,6 +1500,64 @@ func (h *Handler) handleConfigRetrieve(w http.ResponseWriter, r *http.Request, c
 	w.Write([]byte(yamlOutput))
 }
 
+// artifactManifestResponse is the wire shape the host-bootstrap script consumes: the operator-vouched
+// current agent binary + golden archive (version + sha256 each). The script fetches each artifact from
+// Gitea with the config-retrieve git token and verifies its sha256 against THESE values before install
+// — so the hub is the checksum trust root, a different root than Gitea (which only stores the bytes).
+type artifactManifestResponse struct {
+	Agent  artifactEntry `json:"agent"`
+	Golden artifactEntry `json:"golden"`
+}
+
+type artifactEntry struct {
+	Version string `json:"version"`
+	SHA256  string `json:"sha256"`
+}
+
+// handleArtifactManifest serves the current artifact set for a customer. Auth mirrors
+// handleConfigRetrieve EXACTLY (X-Retrieval-Password header, 404-then-401 order, constant-time
+// compare) so a script that can pull the controller.yaml can pull the manifest with the same secret.
+// v0.16.0 returns the GLOBAL current set for every customer (per-customer pinning is a future hook).
+// An unset manifest returns empty fields (not an error) — the script falls back to the local golden
+// and fails clearly on a missing binary.
+func (h *Handler) handleArtifactManifest(w http.ResponseWriter, r *http.Request, customerID string) {
+	if customerID == "" {
+		http.Error(w, "Missing customer_id", http.StatusBadRequest)
+		return
+	}
+
+	password := r.Header.Get("X-Retrieval-Password")
+	if password == "" {
+		http.Error(w, "Unauthorized: X-Retrieval-Password header required", http.StatusUnauthorized)
+		return
+	}
+
+	cfg, err := h.store.GetCustomerConfig(customerID)
+	if err != nil {
+		h.logger.Printf("[ERROR] artifacts: customer lookup failed for %s: %v", customerID, err)
+		http.Error(w, "Internal error", http.StatusInternalServerError)
+		return
+	}
+	if cfg == nil {
+		http.Error(w, "Not found", http.StatusNotFound)
+		return
+	}
+	if subtle.ConstantTimeCompare([]byte(password), []byte(cfg.RetrievalPassword)) != 1 {
+		http.Error(w, "Unauthorized: invalid password", http.StatusUnauthorized)
+		return
+	}
+
+	m := h.store.GetArtifactManifest()
+	resp := artifactManifestResponse{
+		Agent:  artifactEntry{Version: m.AgentVersion, SHA256: m.AgentSHA256},
+		Golden: artifactEntry{Version: m.GoldenVersion, SHA256: m.GoldenSHA256},
+	}
+	h.logger.Printf("[INFO] Artifact manifest served for customer %s (agent=%s golden=%s)", customerID, m.AgentVersion, m.GoldenVersion)
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(resp)
+}
+
 // sendResendEmail sends an email via the Resend HTTP API.
 func (h *Handler) sendResendEmail(to, subject, textBody string) error {
 	payload := map[string]interface{}{