hub v0.61.0 + felhom-tenantsync v1.1.0: Customer RESET (middle lifecycle tier)

One operator action returns a customer to pre-first-install: all operational
state dies (offsite repo, PBS namespace+backups, DR recipe, one-time secret,
claim state, retained escrow custody); identity + basic config + provenance +
events survive. Sits between host delete and customer Delete.

- store/customer_reset.go: customer_resets journal, live inventory, ack-gated
  purge (never touches identity/provenance/events), DeleteClaim.
- claim.ResetToUnclaimed: delete claim row -> fresh code next onboarding.
- offsite.Deprovision (idempotent) + OffsiteIdentifier + ClearProvisionedDescriptor.
- tenantsync.Deprovision + felhom-tenantsync.sh deprovision op (destroys ns +
  backup groups + token; shared user untouched; idempotent).
- web/customer_reset.go: GET reset -> inventory JSON; POST -> orchestration
  (external teardown FIRST, DB purge LAST; refuse-while-hosts; typed-id +
  separate escrow ack). Amber RESET card distinct from red Danger-zone Delete.
- Red-proofs: ack-gate + partial-failure resumability (both proven red);
  store ack-gating + journal round-trip; offsite idempotency + descriptor clear;
  RESET-card render. Green: build + vet + test.

scripts/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Felhom scripts — Changelog
 
+## felhom-tenantsync.sh v1.1.0 — deprovision op (customer RESET teardown) (2026-07-17)
+
+Adds the `{"op":"deprovision","customer_id":"<id>"}` op the slice-1 header explicitly reserved
+("namespace/data deletion is a deliberate, separate decision"). It is exactly that deliberate,
+hub-side ack-gated decision (the customer RESET, hub v0.61.0): delete the token (its ACLs purge with
+it) → delete the residual namespace ACLs → **destroy the namespace AND all its backup groups**
+(`proxmox-backup-client namespace delete <ns> --delete-groups true`, via the transient admin token).
+IDEMPOTENT — a missing token / namespace is success (`deleted:false`), so a re-run after a partial
+reset converges. The shared `felhom@pbs` user is NEVER touched (co-tenants ride it). Returns
+`{"status":"ok","namespace","datastore","deleted":<bool>}`. Secret hygiene unchanged (no secrets in
+this path). Client seam: `tenantsync.Deprovision(ctx, customerID) (existed bool, err error)`.
+
 ## felhom-host-install.sh v1.17.0 — appliance guest auto-sizing (F5) + doc-drift fix (2026-07-17)
 
 Closes `VALIDATION-n100-baremetal-2026-07-16.md` **F5 (MEDIUM):** appliance mode provisioned the