hub v0.7.4: ingest agent pbs_snapshots (slice 6 Phase B)

Accept + persist the now-populated host-report pbs_snapshots. hostPBSSnapshot mirror in
hostReportPayload (persisted via report_json, no schema change); a FAILED PBS verify is
logged prominently (loudest offsite-DR signal). Shared golden updated byte-identical with
felhom-agent; TestHostPBSSnapshot_GoldenContract added. Build/deploy deferred (backward-compatible).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/api/host_test.go

@@ -338,6 +338,32 @@ func TestHostRestoreTest_GoldenContract(t *testing.T) {
 	assertSameStorageKeys(t, "restore_tests[0]", goldenKeys, mirrorKeys)
 }
 
+func TestHostPBSSnapshot_GoldenContract(t *testing.T) {
+	raw, err := os.ReadFile("testdata/host-report.golden.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var golden struct {
+		PBSSnapshots []json.RawMessage `json:"pbs_snapshots"`
+	}
+	if err := json.Unmarshal(raw, &golden); err != nil {
+		t.Fatal(err)
+	}
+	if len(golden.PBSSnapshots) == 0 {
+		t.Fatal("golden has no pbs_snapshots to check")
+	}
+	var goldenKeys map[string]any
+	json.Unmarshal(golden.PBSSnapshots[0], &goldenKeys)
+	var mirror hostPBSSnapshot
+	if err := json.Unmarshal(golden.PBSSnapshots[0], &mirror); err != nil {
+		t.Fatalf("golden pbs snapshot does not parse into the mirror: %v", err)
+	}
+	b, _ := json.Marshal(mirror)
+	var mirrorKeys map[string]any
+	json.Unmarshal(b, &mirrorKeys)
+	assertSameStorageKeys(t, "pbs_snapshots[0]", goldenKeys, mirrorKeys)
+}
+
 func assertSameStorageKeys(t *testing.T, where string, a, b any) {
 	t.Helper()
 	ka, kb := sortedKeys(a), sortedKeys(b)