hub v0.7.4: ingest agent pbs_snapshots (slice 6 Phase B)

Accept + persist the now-populated host-report pbs_snapshots. hostPBSSnapshot mirror in
hostReportPayload (persisted via report_json, no schema change); a FAILED PBS verify is
logged prominently (loudest offsite-DR signal). Shared golden updated byte-identical with
felhom-agent; TestHostPBSSnapshot_GoldenContract added. Build/deploy deferred (backward-compatible).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/api/testdata/host-report.golden.json

@@ -111,7 +111,20 @@
       "duration_seconds": 38.2
     }
   ],
-  "pbs_snapshots": [],
+  "pbs_snapshots": [
+    {
+      "namespace": "root",
+      "backup_type": "ct",
+      "backup_id": "9001",
+      "backup_time": "2026-06-09T14:18:33Z",
+      "size_bytes": 2518889256,
+      "owner": "felhom@pbs!n100",
+      "protected": false,
+      "encrypted": true,
+      "verify_state": "ok",
+      "verify_upid": "UPID:dooplex:00034582:5269BDD7:00000005:6A282176:verify:felhom-spike:felhom@pbs!n100:"
+    }
+  ],
   "cloudflared": { "status": "active" },
   "audit_tail": []
 }