docs: record PBS-DR self-heal drill live-leg result (auto-healed hands-free)

Reconciler observed waiting_secret across two reports (16:52+17:07 UTC), re-staged
the stored secret at 17:10:00 (no ep0 token, no gen bump); agent re-consumed
17:10:26 and converged (applied) 17:10:28 — no operator click. Demo host untouched
(scoped). Fleet widening remains a deliberate follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HEPuEwyyGDJdcsXLFsTWJn

hub/CHANGELOG.md

@@ -36,6 +36,15 @@ existing ep0 token, **zero churn**. This reconciler closes that gap.
   + fake action seam) and `internal/store/pbsdr_test.go` (re-stage semantics + the **no-generation-
   bump** guard + `PBSDRHealStates` parsing). All six §10 red-proofs verified (mutation → FAIL →
   revert). No agent changes (the agent already self-heals once a secret is consumable).
+- **Live-leg (drill guest qm300):** rolled back to `post_day0_golden136` (the re-install
+  reproduction) → stuck `waiting_secret` (marker gone, `felhom-pbs` absent, hub secret consumed).
+  Deployed scoped via `PBSDRHEAL_ONLY_HOST=demo-vm-felhom-2f4b00`. The reconciler observed
+  `waiting_secret` across two reports (16:52 + 17:07 UTC) and at **17:10:00 re-staged** the stored
+  secret (event `pbsdr_selfheal_restaged`; "no ep0 token minted, no generation bump"); the agent
+  **re-consumed at 17:10:26** and **converged (`state=applied`) at 17:10:28** — hands-free, no
+  operator click. The demo host `demo-felhom-01` was never touched (out of the scoped work set).
+  **Fleet-wide widening (remove `PBSDRHEAL_ONLY_HOST`) is a deliberate operator follow-up** — not
+  done in this supervised session.
 
 ## v0.55.0 — accept the offbox_enlarge_blocked event (Task 3a-fix delivery chain) (2026-07-15)