hub v0.157.0: app_definition_refused (R-971), the vault time moves on a re-vault (R-954), the hub's own snapshot count (R-895 slice); uninstall knows felhom-thin-check

- hub: `app_definition_refused` in allowedEventTypes + operatorOnlyEvents (controller v0.328.0's catalog
  allow-list refusal); SaveHostRecoveryCredential moves set_at on a re-vault (found live: both rotated hosts
  kept their first vault's time); the daily key audit also lists the box's restic snapshots/ read-only over the
  login the hub already holds and logs count/newest/oldest (no alarm yet).
- installer (main only, rides the next tag): --uninstall removes /usr/local/sbin/felhom-thin-check (agent
  v0.159.0's bundle file); test_hostinstall.py knows it.
- runbook whole-guest-backup-orphan-thin.md: the human repair the agent's new orphan finding points to.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/notify/dispatcher.go

@@ -871,6 +871,10 @@ var operatorOnlyEvents = map[string]bool{
 	// of empty files found / repaired / still broken / originals lost. The household learns of a lost photo on its own
 	// app page (name and date, on its box); THESE counts are the operator's. Registered in the same commit that mints it.
 	"app_repaired_after_crash": true,
+	// R-971 (v0.157.0, controller v0.328.0, operator decision D2 = A). The box's catalog allow-list refused an app's
+	// definition: someone pushed a catalog change asking for container rights the box does not give. The household can
+	// do nothing; its app page says the app keeps its last good definition. Registered in the same commit that mints it.
+	"app_definition_refused": true,
 }
 
 // IsOperatorOnly reports whether an event type is barred from customer dispatch. Exported so the