hub: HostCapabilityChecker — operator alert on agent capability-degraded (v0.19.0)

Companion to felhom-agent v0.44.0. New monitor.HostCapabilityChecker (sibling of
HostStalenessChecker) reads the capabilities snapshot from the latest host report and emits
agent_capability_degraded/recovered (operator-only, 1h cooldown) on ok<->degraded transitions
for any Critical capability. store.GetHostCapabilities (MAX(id), no migration). Goldens mirror
the new capabilities field.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

hub/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Felhom Hub — Changelog
 
+## v0.19.0 — Agent capability-degraded operator alert (HostCapabilityChecker) (2026-06-29)
+
+Companion to felhom-agent v0.44.0's privileged-capability self-probe: the agent now rides a
+`capabilities` snapshot on its host report (each required `sudo -n` grant: ok/degraded), and the hub
+alerts the operator when a host transitions into a degraded state — closing the loop that let five
+non-root-cutover regressions go undetected until user-visible breakage.
+
+- **`monitor.HostCapabilityChecker` (NEW):** a deliberate SIBLING of `HostStalenessChecker` — same
+  per-host state map (`ok`/`degraded`), seed-without-event, emit-only-on-transition shape. A host is
+  `degraded` iff its latest report has any **Critical** capability with `status:"degraded"`;
+  non-critical degradations ride the report but never alert. Runs on the existing 60s sweep next to
+  the staleness checkers.
+- **Events:** `agent_capability_degraded` (warning) on ok→degraded, naming the degraded capabilities
+  + gated features in the message and details JSON; `agent_capability_recovered` (info) on
+  degraded→ok. Routed through the existing `Dispatcher.ProcessEvent` — **operator-only** (the type
+  is not a customer notification toggle, same as `host_stale`) with the standard 1 h operator
+  cooldown (no per-cycle re-alert).
+- **`store.GetHostCapabilities` (NEW):** reads the capability snapshot from the latest host-report's
+  `report_json` per host (keyed on `MAX(id)` — within-second `received_at` ties would otherwise
+  return multiple rows). **No schema migration** — the array rides the existing report body. A
+  pre-v0.44.0 agent (no `capabilities`) reads as `ok`, so an old agent can't trip a false alert.
+- Cross-repo `host-report.golden.json` mirrors the new `capabilities: []` field (byte-identical with
+  the agent copy). Version `0.18.0 → 0.19.0`.
+
 ## v0.18.0 — App-email passthrough: POST /api/v1/mail → Resend SMTP (2026-06-29)
 
 The hub can now relay a customer box's outbound app email to Resend, re-emitting the raw MIME