R-304 option C (hub half): recovery_older_package allowlisted and operator-only; design + row updated

Unreleased; ships with tomorrow's hub release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/handler.go

@@ -2169,6 +2169,9 @@ var allowedEventTypes = map[string]bool{
 	// R-243 — the hub raises these itself (monitor/offsite_escrow_pending.go); allowlisted like the line above.
 	"offsite_escrow_pending":         true,
 	"offsite_escrow_pending_cleared": true,
+	// R-304 option C — controller (same day) sends it on an unlock that opens / may open an older package. Operator-only
+	// (notify.operatorOnlyEvents); NO customerMessages entry.
+	"recovery_older_package": true,
 	// controller v0.289.0 (decision 69): the customer-chosen deletion of set-aside history is deferred
 	// to the operator — the box's append-only key cannot delete. Operator-only (notify.operatorOnlyEvents).
 	"offbox_abandon_deferred": true,