hub: the held-floor REASON must match the CAUSE (CAMPAIGN-11 follow-on)

v0.97.0 introduced a second hold reason and left both surfaces printing the first. The
freshly deployed hub logged, for the campaign box:

  managed floor HELD for c11: agent "0.125.0" < MinAgent 0.113.0

which is FALSE — 0.125.0 is ABOVE 0.113.0. That box is held because its floor sits above
the vouched golden, not because of its agent. CLAUDE.md's corollary exactly: when a verdict
changes which field it counts from, the alarm text has to change with it, or a true alarm
reads as one to dismiss.

Both the ACK log line and the Hosts-dashboard HeldReason now come from one
ManagedFloorDecision.HoldReason(), and TestResolveManagedFloor_HoldReasonMatchesTheCause
pins each reason to its cause.

hub/CHANGELOG.md

@@ -41,6 +41,14 @@ either way. **Only rows that actually carry an identity blob count**: the pre-v0
 retain nothing the screen could be talking about. It is a boolean and a timestamp; it grants **no read
 path**, which is still unbuilt (R-199's inventory).
 
+**And the hold REASON now matches the hold CAUSE.** Adding a second reason and leaving both surfaces
+printing the first is `CLAUDE.md`'s corollary, and it happened here: the freshly deployed hub logged
+`managed floor HELD for c11: agent "0.125.0" < MinAgent 0.113.0` — a comparison that is FALSE
+(0.125.0 is above 0.113.0) for a box held because its floor sat above the golden. Both the ACK log
+line and the Hosts-dashboard `HeldReason` now come from one `ManagedFloorDecision.HoldReason()`, and a
+test pins each reason to its cause. A true alarm that misdescribes itself is one the operator learns
+to dismiss.
+
 Tests: `managed_floor_test.go` — the campaign's exact numbers, held-regardless-of-agent, Scenario C
 (uncoupled untouched), floor==golden unchanged, unparseable golden. **Red-proof: removing the
 floor-above-golden branch reproduces the campaign's measurement exactly.**