hub + manifests: operator bearer out of git (secretKeyRef report-api)

The global bearer (api.report_api_key) leaves manifests/hub.yaml: the
ConfigMap field is an empty placeholder; the Deployment injects
REPORT_API_KEY from out-of-band Secret/report-api (deliberately NOT
optional - a missing Secret fails Ready rather than booting a hub with an
empty bearer). main.go gains the REPORT_API_KEY env override (the
RESEND_API_KEY twin). scripts/manifest_secret_gate.py blocks bearer-shaped
(64-hex) literals across manifests/ (felhom.secret.yaml's pre-existing
umami APP_SECRET is a visible non-fatal KNOWN-BACKLOG line - secrets.md
backlog, out of scope here).

Ordering (load-bearing): create Secret/report-api with the CURRENT value
BEFORE syncing; this manifest change rides the same sync as the 0.53.0
image (older images ignore the env override). The exposed git-history copy
dies only with the supervised ROTATION - procedure + consumer list in
documentation/runbooks/secrets.md ("Operator/global bearer key"); both
publish runbooks' ROTATION notes now point at that disposition. The
controller repo's example-config copy of the literal is scrubbed
(felhom-controller 51c871a).

Red-proof E: reintroducing a 64-hex literal into manifests/hub.yaml ->
gate exit 1 (recorded); restored clean.

documentation/pilot/RUNBOOK-publish-0.81-0.113-2026-07-11.md

@@ -115,6 +115,9 @@ rollout OK, live env verified 0.113.0, clean hub startup log. Demo: no churn (al
   one of the three known committed secrets on the rotate+de-git backlog) and was additionally
   exposed in a session screenshot during Phase D. Rotate it + move to a `secretKeyRef` (the
   Resend-key pattern, documentation/runbooks/secrets.md) as the next operator hygiene task.
+  **DISPOSITION 2026-07-13 (hub v0.53.0):** de-git DONE (`secretKeyRef: report-api/REPORT_API_KEY`
+  + `scripts/manifest_secret_gate.py`); the value rotation is the supervised procedure in
+  documentation/runbooks/secrets.md §"Operator/global bearer key".
 
 ## END STATE
 

documentation/pilot/RUNBOOK-publish-0.85-0.120-2026-07-12.md

@@ -92,9 +92,13 @@ floor lands his controller at 0.120 automatically.
 
 - No key material or tokens in any transcript; publish creds stayed as `$(cat ~/.gitea-token)`
   env-substitution on 180; drill-VM token shredded; saved-log leak grep 0.
-- **⚠ ROTATION STILL DUE:** the hub operator bearer key is COMMITTED in git (`manifests/hub.yaml`) —
+- ~~**⚠ ROTATION STILL DUE:** the hub operator bearer key is COMMITTED in git (`manifests/hub.yaml`) —
   carried over from the 0.81/0.113 train. Rotate + move to a `secretKeyRef` (Resend-key pattern,
-  documentation/runbooks/secrets.md) as an operator hygiene task.
+  documentation/runbooks/secrets.md) as an operator hygiene task.~~
+  **DISPOSITION 2026-07-13 (hub v0.53.0):** moved to `secretKeyRef: report-api/REPORT_API_KEY`
+  (literal removed from the manifest; `scripts/manifest_secret_gate.py` blocks reintroduction).
+  The value ROTATION itself is the supervised step in documentation/runbooks/secrets.md
+  §"Operator/global bearer key" — the git-history copy is dead only after it runs.
 
 ## END STATE