hub v0.157.0: app_definition_refused (R-971), the vault time moves on a re-vault (R-954), the hub's own snapshot count (R-895 slice); uninstall knows felhom-thin-check

- hub: `app_definition_refused` in allowedEventTypes + operatorOnlyEvents (controller v0.328.0's catalog
  allow-list refusal); SaveHostRecoveryCredential moves set_at on a re-vault (found live: both rotated hosts
  kept their first vault's time); the daily key audit also lists the box's restic snapshots/ read-only over the
  login the hub already holds and logs count/newest/oldest (no alarm yet).
- installer (main only, rides the next tag): --uninstall removes /usr/local/sbin/felhom-thin-check (agent
  v0.159.0's bundle file); test_hostinstall.py knows it.
- runbook whole-guest-backup-orphan-thin.md: the human repair the agent's new orphan finding points to.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/test_hostinstall.py

@@ -36,6 +36,7 @@ BUNDLE_DESTS = [
     "/usr/local/sbin/felhom-pbs-apply",
     "/usr/local/sbin/felhom-backup-target-apply",
     "/usr/local/sbin/felhom-vzdump-partial-clean",   # agent v0.156.1 (R-1006)
+    "/usr/local/sbin/felhom-thin-check",             # agent v0.159.0 (R-1012)
     "/usr/local/sbin/felhom-internal-place",         # agent v0.158.0 (felhom.eu `16` §5)
     "/usr/local/sbin/felhom-os-apply",
     "/usr/local/sbin/felhom-crash-guard",