docs: 06-doc S3 SHIPPED (agent v0.64.0) + agent-side revocation semantics + CONTEXT/REPORT

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CONTEXT.md

@@ -3,6 +3,17 @@
 > Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
 > `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
 
+- **2026-07-04 — S3 SHIPPED: agent WG tunnel (felhom-agent v0.64.0; docs-only here)** — the
+  doc-06 §3.3 handshake is now END-TO-END LIVE on demo: agent keygen → `POST /hosts/{id}/wg` →
+  desired-state `wireguard` block → agent-managed `wg-quick@wg-felhom` → PBS page over
+  10.77.0.1:8007 in 3 s. **`wg_tunnel.enabled` defaults FALSE agent-side** (rollouts to other
+  boxes are no-ops until the production endpoint exists). Revocation semantics completed (§3.5):
+  removed peer → agent disables + keeps its marker + NEVER re-registers; operator re-adds via the
+  pubkey the heartbeat report now carries. Escrow: `IdentityBundle.WGPrivateKey` auto-injected on
+  new escrow-create runs (pre-S3 blobs can't be retrofitted — honest fallback = fresh-key
+  re-register, /32 kept). OPEN: CGNAT/mobile-hotspot smoke (operator-assisted appendix, deferred
+  non-blocking); S4 = PBS over the tunnel; hub-side S6 = tunnel-health alerting on the new report
+  stanza. Detail: felhom-agent CHANGELOG v0.64.0 + REPORT.
 - **2026-07-04 — S2 SHIPPED: box-facing WG registration + wireguard desired-state block + /offsite UI (hub v0.33.0)** —
   doc-06 row S2. DECISIONS: the WG assignment is **hub-owned state, merged into served
   desired-state at READ time** — stored `desired_json` stays a pure operator blob; admin PUT with