hub v0.7.4: ingest agent pbs_snapshots (slice 6 Phase B)

Accept + persist the now-populated host-report pbs_snapshots. hostPBSSnapshot mirror in
hostReportPayload (persisted via report_json, no schema change); a FAILED PBS verify is
logged prominently (loudest offsite-DR signal). Shared golden updated byte-identical with
felhom-agent; TestHostPBSSnapshot_GoldenContract added. Build/deploy deferred (backward-compatible).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Felhom Hub — Changelog
 
+## v0.7.4 — ingest agent pbs_snapshots (slice 6 Phase B) (2026-06-09)
+
+The agent's slice-6 Phase B work populates the host-report's `pbs_snapshots` (the PBS offsite
+inventory + per-snapshot verify-state). This is the hub half: accept + persist them. Minimal —
+the rich offsite policy is hub-owned (slice 10); this mirrors what the agent reports.
+
+### Added
+- **`hostPBSSnapshot`** mirror struct in `hostReportPayload` (`internal/api/handler.go`) —
+  field-for-field with the agent's `hub.PBSSnapshot` wire contract (namespace/backup_type/
+  backup_id/backup_time/size_bytes/owner/protected/encrypted/verify_state/verify_upid).
+  Persisted via `report_json` (no new columns — the slice-5/6A precedent).
+- **A FAILED PBS verify is logged prominently** (`[WARN]` — the loudest offsite-DR signal,
+  same treatment as a failed restore-test). The `host-report` info line now counts pbs-snapshots.
+- **`testdata/host-report.golden.json`** updated with a populated `pbs_snapshots[0]`, kept
+  **byte-identical** with felhom-agent's copy.
+- **`TestHostPBSSnapshot_GoldenContract`** — the hub half of the bidirectional key-set test.
+
+### Notes
+- Backward-compatible: an agent that omits/empties `pbs_snapshots` is accepted unchanged.
+
 ## v0.7.3 — ingest agent backups + restore_tests (slice 6 Phase A) (2026-06-09)
 
 The agent's slice-6 work populates the host-report's `backups` + `restore_tests` (the