R-366 slice 2 (decision 168): one operator line when the box's whole-guest archives include another key's (edge-triggered)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/store/store.go

@@ -2286,6 +2286,17 @@ func (s *Store) setSetting(key, value string) error {
 	return err
 }
 
+// ForeignKeyArchiveSignature / SetForeignKeyArchiveSignature (R-366 slice 2) hold, per host, the last reported set of
+// whole-guest archives written with another key, so the operator event fires once per CHANGE, not every report.
+func (s *Store) ForeignKeyArchiveSignature(hostID string) string {
+	return s.getSetting("foreign_key_archives:" + hostID)
+}
+
+// SetForeignKeyArchiveSignature stores the host's current signature ("" = none).
+func (s *Store) SetForeignKeyArchiveSignature(hostID, sig string) error {
+	return s.setSetting("foreign_key_archives:"+hostID, sig)
+}
+
 // GetArtifactManifest returns the operator-recorded current artifact set. All-empty when nothing
 // has been published yet.
 func (s *Store) GetArtifactManifest() ArtifactManifest {