hub v0.68.1 — fix the Configuration layout broken by the wrapper-sha field

The v0.68.0 row wrapped itself in a <div>, but the artifacts <form> IS the CSS grid
(display:grid, no inner container). The stray </div> closed the surrounding card from
inside the form and the new <div> was never closed — it swallowed the submit button and
ran to </form>, so the row rendered outside the card and Save landed inline. Reported by
the operator on first use.

The field still submitted (it stayed inside the form), so this was layout damage rather
than data loss, but the unbalanced markup put every section below it in the wrong
container.

Fixed as plain grid cells (grid-column: 2/4), no nested elements.

There was no render assertion on this form at all, which is why a hand-edit broke it
silently. The new test asserts the field is inside the form, the button has not escaped,
the form contains ZERO divs, whole-page div balance holds, and the sections after it
survive. Red-proofed against the broken shape.

hub/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Felhom Hub — Changelog
 
+## v0.68.1 — fix the Configuration page layout broken by the wrapper-sha field (2026-07-21)
+
+The v0.68.0 wrapper-sha256 row wrapped itself in a `<div>`. The artifacts **`<form>` IS the CSS
+grid** (`display: grid`, no inner container), so the stray `</div>` closed the surrounding CARD from
+inside the form, and the newly-opened `<div>` was never closed — it swallowed the submit button and
+ran to `</form>`. The row rendered outside the card at full page width and "Save artifact manifest"
+landed inline. Reported by the operator on first use.
+
+The field still submitted (it remained inside the form), so this was layout damage rather than data
+loss — but the unbalanced markup put every section below it inside the wrong container.
+
+Fixed by making the row plain grid cells (`grid-column: 2 / 4` for the input and the hint), with no
+nested elements at all.
+
+**There was no render assertion on this form**, which is why a hand-edit could break it silently.
+`TestConfigurationArtifactsForm_Structure` now asserts the field is inside the form, the submit
+button has not escaped, the form contains **zero** `<div>`s, whole-page div balance holds, and the
+sections that render after it still exist. Red-proofed by restoring the broken shape.
+
 ## v0.68.0 — a credential re-issue finally re-arms the box (R-39 fleet fix) + wrapper drift is visible (R-50b(a)) (2026-07-21)
 
 **Coupling, stated honestly: this release is SAFE for agents at 0.90.0** — the new descriptor field