hub v0.121.0: app_oom_storm allow-listed, operator-only, per-app cooldown (R-636)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/notify/dispatcher.go

@@ -392,6 +392,9 @@ var perAppCooldownEvents = map[string]bool{
 	// v0.120.0: an update outcome is per app with no digest — two apps on one night are two alarms.
 	"app_update_undone": true,
 	"app_update_held":   true,
+	// v0.121.0 (R-636): a storm is one app's event with no digest behind it — two apps storming on one
+	// night are two alarms. (The controller already sends it at most once per container run.)
+	"app_oom_storm": true,
 }
 
 // perAppCustomerCooldownEvents is the CUSTOMER-leg sibling of perAppCooldownEvents (v0.120.0). The
@@ -652,6 +655,10 @@ var operatorOnlyEvents = map[string]bool{
 	// names — the household's side is the dashboard tag. Registered in the same commit.
 	"backup_tier_skipped": true,
 	"app_oom":             true,
+	// R-636 (v0.121.0, controller v0.265.0). The LOUDER sibling of app_oom: the same container run
+	// OOM-killed 20+ times in 30 minutes. Same audience, same reason — raw container names and memory
+	// figures; the household's side is the dashboard. Registered in the same commit that mints it.
+	"app_oom_storm": true,
 }
 
 // IsOperatorOnly reports whether an event type is barred from customer dispatch. Exported so the