feat(hub): v0.70.0 — a deleted customer actually disappears (residue leg + ghost cleanup)

Found validating v0.69.0 against the live hub. demo-vm-felhom was deleted
on 07-18 and was still on the Customers list AND still raising offsite_stale
(10 events, latest 07-21 17:34, operator email at 19:34) — because
GetCustomers() is report-derived and no lifecycle tier ever deleted a report.

New leg 3 (residue), before the record purge: reports, app_telemetry,
app_log_tails, log_tail_requests, customer_notifications, plus the
credential-bearing appliance_registrations and selfbind_tokens. Audit
(events, notification_log) and F-14 provenance still survive.

Ghost customers are now deletable: 404 means "nothing here", not "no config
row". With no config row the offsite descriptor is unknowable, so the Hetzner
and descriptor legs record skipped_no_config rather than a bare "skipped".

Two more red-proofs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J55BQE1gE2V4ffud5jweGS

hub/internal/store/customer_reset.go

@@ -25,8 +25,8 @@ type CustomerReset struct {
 // ResetInventory is the live count of what a RESET would destroy (the confirm surface, ruling 4).
 // Sub-account name + PBS namespace are added by the web layer from the external clients.
 type ResetInventory struct {
-	HostCount            int  // ruling 3: RESET refuses while any host row exists
-	SupersededBlobs      int  // M — retained recovery-key custody destroyed (ack-gated)
+	HostCount            int // ruling 3: RESET refuses while any host row exists
+	SupersededBlobs      int // M — retained recovery-key custody destroyed (ack-gated)
 	DRRecipePresent      bool
 	OneTimeSecretPresent bool
 	ClaimPresent         bool