hub: restore-test "passed with warnings" visibility (v0.7.5)

Phase B (hub half) of the restore-test warning fix. The agent v0.7.0 now passes a
restore-test that emitted a benign start advisory (systemd-nesting) and carries the
warning text on the wire.

- hostRestoreTest gains warnings + warnings_recognized mirror fields (omitempty;
  absent recognized => false => louder unrecognized path)
- ingest logs [INFO] passed WITH WARNINGS (recognized), [WARN] for unrecognized;
  FAILED still [WARN]
- golden restore_tests[0] gains the keys, byte-identical with felhom-agent (sha256
  e6999d77...); bidirectional key-set contract test round-trips them
- no dashboard widget: no host-domain dashboard surface exists yet (log+persist only,
  as with pbs_snapshots) -- deferred to slice 10

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Felhom Hub — Changelog
 
+## v0.7.5 — restore-test "passed with warnings" visibility (2026-06-09)
+
+Hub half of `TASK — Restore-test must not false-fail on benign start warnings` (Phase B). The
+agent (v0.7.0) now treats a guest-start advisory like the systemd-nesting warning as a PASS
+(verdict is liveness, not the start exitstatus) and carries the warning text on the wire. This
+makes that visible to the operator instead of indistinguishable from a clean pass.
+
+### Added
+- `hostRestoreTest.warnings` (`[]string`) + `warnings_recognized` (`bool`) mirror fields, matching
+  the agent's `hub.RestoreTest` wire contract (`omitempty`; an absent `warnings_recognized` ⇒
+  `false` ⇒ treated as the louder unrecognized case — a missing flag can only over-notice).
+
+### Changed
+- Host-report ingest now surfaces a **passed** restore-test that carried warnings:
+  `[INFO] restore-test passed WITH WARNINGS (recognized)` when every warning is the known-benign
+  anchor, escalated to `[WARN] … UNRECOGNIZED WARNINGS` otherwise — as loud as a failed PBS
+  verify, so a real restore warning can't hide behind a green pass. A FAILED restore-test still
+  logs the existing `[WARN] … FAILED`.
+
+### Tests / contract
+- `restore_tests[0]` in the host-report golden gains `warnings` + `warnings_recognized`; the golden
+  stays **byte-identical** with felhom-agent's copy (sha256-verified) and the bidirectional
+  key-set contract test now round-trips the new keys through `hostRestoreTest`.
+
+### Not in this slice
+- No dashboard widget: the hub web layer renders only controller-report data — there is no
+  host-domain dashboard surface yet (guests/storage/restore_tests/pbs_snapshots are log+persist
+  only, same as the failed-PBS-verify signal). Distinct dashboard treatment lands when the
+  host-domain dashboard does (slice 10). The operator signal this slice is the log line.
+
 ## v0.7.4 — ingest agent pbs_snapshots (slice 6 Phase B) (2026-06-09)
 
 The agent's slice-6 Phase B work populates the host-report's `pbs_snapshots` (the PBS offsite